Linux Analysis Report
firmware.i586.elf

Overview

General Information

Sample name:	firmware.i586.elf
Analysis ID:	1502463
MD5:	307c851a7a0c4b7dd8afd2abd662480c
SHA1:	4e2b66521a16a174fcd6581357d289f1ede59cb1
SHA256:	6d7a2a182467276297c8a84a5d2840e7ee335fb985f63cda9e618b229973e1a2
Tags:	elffirmware
Infos:

Detection

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Drops files in suspicious directories

Executes the "crontab" command typically for achieving persistence

Machine Learning detection for dropped file

Machine Learning detection for sample

Sample tries to persist itself using cron

Tries to resolve many domain names, but no domain seems valid

Connects to many different domains

Detected TCP or UDP traffic on non-standard ports

Executes commands using a shell command-line interpreter

Executes massive DNS lookups (> 100)

Executes the "hostname" command used to retrieve the computers name

HTTP GET or POST without a user agent

Sample has stripped symbol table

Sample tries to set the executable flag

Writes ELF files to disk

Yara signature match

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: firmware.i586.elf

Avira: detected

Antivirus detection for dropped file

Source: /usr/bin/gpcwo

Avira: detection malicious, Label: EXP/ELF.Mirai.L

Multi AV Scanner detection for submitted file

Source: firmware.i586.elf	ReversingLabs: Detection: 55%
Source: firmware.i586.elf	Virustotal: Detection: 56%			Perma Link

Machine Learning detection for dropped file

Source: /usr/bin/gpcwo

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: firmware.i586.elf

Joe Sandbox ML: detected

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: eddf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bkaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fafl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aedb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kfae.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: llba.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: aaek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kcld.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bkaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ldcc.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.blkb.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: elbf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aclk.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fkke.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.dkdd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fkke.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kfae.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.bffl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.effl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.abba.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.deak.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaaa.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.dkcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akak.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aaaa.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fcaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kcek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.caal.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aaek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acce.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.alaa.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.akak.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: kcek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fcaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bkaf.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.bkcd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.elcc.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaaa.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: kcld.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dkdd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.eddf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.elbf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: blkb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ccka.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.cfkf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.lbaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kcld.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: effl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bdkb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.acce.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.aakd.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.ecll.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lbaf.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: ldcc.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: clbl.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: lbaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cklb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aedb.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.llba.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: dkcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aclk.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cfkf.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.kfae.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.dbda.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aedb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aakd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aakd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bkcd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kaaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bdab.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bdkb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bdab.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.clbl.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.cllk.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.cklb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.akcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bkaf.ru replaycode: Server failure (2)

Connects to many different domains

Source: unknown

Network traffic detected: DNS query count 227

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:60948 -> 48.46.49.0:8202
Source: global traffic	TCP traffic: 192.168.2.13:43514 -> 48.46.49.51:0
Source: global traffic	TCP traffic: 192.168.2.13:52340 -> 48.46.50.53:0
Source: global traffic	TCP traffic: 192.168.2.13:46482 -> 8.8.8.8:81

Executes massive DNS lookups (> 100)

Source: global traffic

DNS traffic detected: number of DNS queries: 227

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 54.185.169.30Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.180.204.221Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.182.5.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.67.71.32Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.161.68.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.198.188Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.254.19.206Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.99.6.92Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 14.215.143.125
Source: unknown	TCP traffic detected without corresponding DNS query: 167.82.77.125
Source: unknown	TCP traffic detected without corresponding DNS query: 165.233.20.104
Source: unknown	TCP traffic detected without corresponding DNS query: 135.57.153.23
Source: unknown	TCP traffic detected without corresponding DNS query: 49.122.84.171
Source: unknown	TCP traffic detected without corresponding DNS query: 67.56.219.192
Source: unknown	TCP traffic detected without corresponding DNS query: 80.72.162.208
Source: unknown	TCP traffic detected without corresponding DNS query: 141.9.68.142
Source: unknown	TCP traffic detected without corresponding DNS query: 12.234.246.47
Source: unknown	TCP traffic detected without corresponding DNS query: 180.136.160.167
Source: unknown	TCP traffic detected without corresponding DNS query: 103.4.232.51
Source: unknown	TCP traffic detected without corresponding DNS query: 49.174.205.252
Source: unknown	TCP traffic detected without corresponding DNS query: 162.67.70.167
Source: unknown	TCP traffic detected without corresponding DNS query: 216.251.228.90
Source: unknown	TCP traffic detected without corresponding DNS query: 152.31.0.50
Source: unknown	TCP traffic detected without corresponding DNS query: 164.0.98.134
Source: unknown	TCP traffic detected without corresponding DNS query: 209.231.95.38
Source: unknown	TCP traffic detected without corresponding DNS query: 14.89.32.195
Source: unknown	TCP traffic detected without corresponding DNS query: 53.163.221.82
Source: unknown	TCP traffic detected without corresponding DNS query: 94.153.224.160
Source: unknown	TCP traffic detected without corresponding DNS query: 199.115.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 153.123.46.70
Source: unknown	TCP traffic detected without corresponding DNS query: 206.68.137.23
Source: unknown	TCP traffic detected without corresponding DNS query: 221.214.198.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.180.197.118
Source: unknown	TCP traffic detected without corresponding DNS query: 150.227.186.79
Source: unknown	TCP traffic detected without corresponding DNS query: 173.189.180.36
Source: unknown	TCP traffic detected without corresponding DNS query: 205.238.18.104
Source: unknown	TCP traffic detected without corresponding DNS query: 88.31.238.229
Source: unknown	TCP traffic detected without corresponding DNS query: 166.49.41.202
Source: unknown	TCP traffic detected without corresponding DNS query: 222.187.114.197
Source: unknown	TCP traffic detected without corresponding DNS query: 65.75.76.138
Source: unknown	TCP traffic detected without corresponding DNS query: 12.123.158.52
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.51.131
Source: unknown	TCP traffic detected without corresponding DNS query: 211.170.28.6
Source: unknown	TCP traffic detected without corresponding DNS query: 181.173.136.207
Source: unknown	TCP traffic detected without corresponding DNS query: 20.130.248.92
Source: unknown	TCP traffic detected without corresponding DNS query: 129.137.162.130
Source: unknown	TCP traffic detected without corresponding DNS query: 221.5.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 113.185.173.162
Source: unknown	TCP traffic detected without corresponding DNS query: 174.109.246.163
Source: unknown	TCP traffic detected without corresponding DNS query: 51.185.61.225
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.169.29
Source: unknown	TCP traffic detected without corresponding DNS query: 138.236.82.138
Source: unknown	TCP traffic detected without corresponding DNS query: 160.27.81.198
Source: unknown	TCP traffic detected without corresponding DNS query: 80.16.197.124
Source: unknown	TCP traffic detected without corresponding DNS query: 211.137.81.51
Source: unknown	TCP traffic detected without corresponding DNS query: 9.39.114.53
Source: unknown	TCP traffic detected without corresponding DNS query: 32.131.248.29
Source: unknown	TCP traffic detected without corresponding DNS query: 17.185.226.204

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 54.185.169.30Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.180.204.221Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.182.5.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.67.71.32Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.161.68.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.198.188Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.254.19.206Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.99.6.92Connection: close

Source: global traffic	DNS traffic detected: DNS query: akak.ru
Source: global traffic	DNS traffic detected: DNS query: www.akak.ru
Source: global traffic	DNS traffic detected: DNS query: ekac.ru
Source: global traffic	DNS traffic detected: DNS query: www.ekac.ru
Source: global traffic	DNS traffic detected: DNS query: fafe.ru
Source: global traffic	DNS traffic detected: DNS query: www.fafe.ru
Source: global traffic	DNS traffic detected: DNS query: ckea.ru
Source: global traffic	DNS traffic detected: DNS query: www.ckea.ru
Source: global traffic	DNS traffic detected: DNS query: fkke.ru
Source: global traffic	DNS traffic detected: DNS query: www.fkke.ru
Source: global traffic	DNS traffic detected: DNS query: leea.ru
Source: global traffic	DNS traffic detected: DNS query: www.leea.ru
Source: global traffic	DNS traffic detected: DNS query: alad.ru
Source: global traffic	DNS traffic detected: DNS query: www.alad.ru
Source: global traffic	DNS traffic detected: DNS query: ccbd.ru
Source: global traffic	DNS traffic detected: DNS query: www.ccbd.ru
Source: global traffic	DNS traffic detected: DNS query: cdlk.ru
Source: global traffic	DNS traffic detected: DNS query: www.cdlk.ru
Source: global traffic	DNS traffic detected: DNS query: kcld.ru
Source: global traffic	DNS traffic detected: DNS query: www.kcld.ru
Source: global traffic	DNS traffic detected: DNS query: addl.ru
Source: global traffic	DNS traffic detected: DNS query: www.addl.ru
Source: global traffic	DNS traffic detected: DNS query: dack.ru
Source: global traffic	DNS traffic detected: DNS query: www.dack.ru
Source: global traffic	DNS traffic detected: DNS query: eclf.ru
Source: global traffic	DNS traffic detected: DNS query: www.eclf.ru
Source: global traffic	DNS traffic detected: DNS query: clak.ru
Source: global traffic	DNS traffic detected: DNS query: www.clak.ru
Source: global traffic	DNS traffic detected: DNS query: acad.ru
Source: global traffic	DNS traffic detected: DNS query: www.acad.ru
Source: global traffic	DNS traffic detected: DNS query: alaa.ru
Source: global traffic	DNS traffic detected: DNS query: www.alaa.ru
Source: global traffic	DNS traffic detected: DNS query: edla.ru
Source: global traffic	DNS traffic detected: DNS query: www.edla.ru
Source: global traffic	DNS traffic detected: DNS query: aedb.ru
Source: global traffic	DNS traffic detected: DNS query: www.aedb.ru
Source: global traffic	DNS traffic detected: DNS query: aakd.ru
Source: global traffic	DNS traffic detected: DNS query: www.aakd.ru
Source: global traffic	DNS traffic detected: DNS query: abba.ru
Source: global traffic	DNS traffic detected: DNS query: www.abba.ru
Source: global traffic	DNS traffic detected: DNS query: ckda.ru
Source: global traffic	DNS traffic detected: DNS query: www.ckda.ru
Source: global traffic	DNS traffic detected: DNS query: allk.ru
Source: global traffic	DNS traffic detected: DNS query: www.allk.ru
Source: global traffic	DNS traffic detected: DNS query: kfaf.ru
Source: global traffic	DNS traffic detected: DNS query: www.kfaf.ru
Source: global traffic	DNS traffic detected: DNS query: bebc.ru
Source: global traffic	DNS traffic detected: DNS query: www.bebc.ru
Source: global traffic	DNS traffic detected: DNS query: daea.ru
Source: global traffic	DNS traffic detected: DNS query: www.daea.ru
Source: global traffic	DNS traffic detected: DNS query: cdke.ru
Source: global traffic	DNS traffic detected: DNS query: www.cdke.ru
Source: global traffic	DNS traffic detected: DNS query: deak.ru
Source: global traffic	DNS traffic detected: DNS query: www.deak.ru
Source: global traffic	DNS traffic detected: DNS query: caee.ru
Source: global traffic	DNS traffic detected: DNS query: www.caee.ru
Source: global traffic	DNS traffic detected: DNS query: cafk.ru
Source: global traffic	DNS traffic detected: DNS query: www.cafk.ru
Source: global traffic	DNS traffic detected: DNS query: cabl.ru
Source: global traffic	DNS traffic detected: DNS query: www.cabl.ru
Source: global traffic	DNS traffic detected: DNS query: akda.ru
Source: global traffic	DNS traffic detected: DNS query: www.akda.ru
Source: global traffic	DNS traffic detected: DNS query: kfae.ru
Source: global traffic	DNS traffic detected: DNS query: www.kfae.ru
Source: global traffic	DNS traffic detected: DNS query: effl.ru
Source: global traffic	DNS traffic detected: DNS query: www.effl.ru
Source: global traffic	DNS traffic detected: DNS query: bkaf.ru
Source: global traffic	DNS traffic detected: DNS query: www.bkaf.ru
Source: global traffic	DNS traffic detected: DNS query: dlba.ru
Source: global traffic	DNS traffic detected: DNS query: www.dlba.ru
Source: global traffic	DNS traffic detected: DNS query: lkbf.ru
Source: global traffic	DNS traffic detected: DNS query: www.lkbf.ru
Source: global traffic	DNS traffic detected: DNS query: fabd.ru
Source: global traffic	DNS traffic detected: DNS query: www.fabd.ru
Source: global traffic	DNS traffic detected: DNS query: ldlc.ru
Source: global traffic	DNS traffic detected: DNS query: www.ldlc.ru
Source: global traffic	DNS traffic detected: DNS query: dfca.ru
Source: global traffic	DNS traffic detected: DNS query: www.dfca.ru
Source: global traffic	DNS traffic detected: DNS query: ccka.ru
Source: global traffic	DNS traffic detected: DNS query: www.ccka.ru
Source: global traffic	DNS traffic detected: DNS query: kaaf.ru
Source: global traffic	DNS traffic detected: DNS query: www.kaaf.ru
Source: global traffic	DNS traffic detected: DNS query: bdab.ru
Source: global traffic	DNS traffic detected: DNS query: www.bdab.ru
Source: global traffic	DNS traffic detected: DNS query: aacd.ru
Source: global traffic	DNS traffic detected: DNS query: www.aacd.ru
Source: global traffic	DNS traffic detected: DNS query: lkbk.ru
Source: global traffic	DNS traffic detected: DNS query: www.lkbk.ru
Source: global traffic	DNS traffic detected: DNS query: fakk.ru
Source: global traffic	DNS traffic detected: DNS query: www.fakk.ru
Source: global traffic	DNS traffic detected: DNS query: kaad.ru
Source: global traffic	DNS traffic detected: DNS query: www.kaad.ru
Source: global traffic	DNS traffic detected: DNS query: ecll.ru
Source: global traffic	DNS traffic detected: DNS query: www.ecll.ru
Source: global traffic	DNS traffic detected: DNS query: afea.ru
Source: global traffic	DNS traffic detected: DNS query: www.afea.ru
Source: global traffic	DNS traffic detected: DNS query: aakl.ru
Source: global traffic	DNS traffic detected: DNS query: www.aakl.ru
Source: global traffic	DNS traffic detected: DNS query: kcek.ru
Source: global traffic	DNS traffic detected: DNS query: www.kcek.ru

System Summary

Malicious sample detected (through community Yara rule)

Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: dropped/gpcwo, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal96.troj.evad.linELF@0/24@1251/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 5791)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior
Source: /bin/sh (PID: 5790)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior

Sample tries to persist itself using cron

Source: /tmp/firmware.i586.elf (PID: 5767)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5768)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 5791)	File: /var/spool/cron/crontabs/tmp.nFhVQ3	Jump to behavior
Source: /usr/bin/crontab (PID: 5791)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 5790)	File: /var/spool/cron/crontabs/tmp.1Z62b3	Jump to behavior
Source: /usr/bin/crontab (PID: 5790)	File: /var/spool/cron/crontabs/root	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/firmware.i586.elf (PID: 5778)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5821)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5848)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5857)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5865)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5878)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5886)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5892)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5929)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5937)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5948)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5957)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5783)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5794)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5798)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5789)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5777)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5819)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5846)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5855)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5863)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5873)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5882)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5925)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5935)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5946)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5955)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5781)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5792)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5796)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5788)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior

Executes the "hostname" command used to retrieve the computers name

Source: /bin/sh (PID: 5786)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5822)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5849)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5858)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5866)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5879)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5887)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5893)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5930)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5938)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5949)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5958)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5787)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5795)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5799)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5784)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5820)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5847)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5856)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5864)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5874)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5883)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5926)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5936)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5947)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5956)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5785)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5793)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5797)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior

Sample tries to set the executable flag

Source: /tmp/firmware.i586.elf (PID: 5767)	File: /bin/gpcwo (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5768)	File: /bin/gpcwo (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Writes ELF files to disk

Source: /tmp/firmware.i586.elf (PID: 5767)	File written: /usr/bin/gpcwo
Source: /tmp/firmware.i586.elf (PID: 5768)	File written: /usr/bin/gpcwo			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/firmware.i586.elf (PID: 5767)	File: /usr/bin/gpcwo
Source: /tmp/firmware.i586.elf (PID: 5768)	File: /usr/bin/gpcwo			Jump to dropped file

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
42.129.47.124	unknown	China	4249	LILLY-ASUS	false
173.243.113.92	unknown	United States	20278	NEXEONUS	false
92.106.224.76	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
223.170.234.184	unknown	Korea Republic of	7641	CHINABTNChinaBroadcastingTVNetCN	false
156.141.153.98	unknown	United States	29975	VODACOM-ZA	false
213.199.213.209	unknown	Poland	25070	COMARCH-ASPL	false
193.224.82.252	unknown	Hungary	1955	HBONE-ASHUNGARNETHU	false
218.50.52.65	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
151.56.237.113	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
167.164.160.204	unknown	United States	59447	SAYFANETTR	false
113.20.43.64	unknown	New Caledonia	45461	TELENET-AS-APTeleNetNC	false
111.238.136.111	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
116.199.246.186	unknown	Japan	59127	NCVNewmediaCorporationJP	false
193.141.250.22	unknown	Germany	1136	KPNKPNNationalEU	false
32.131.99.226	unknown	United States	2686	ATGS-MMD-ASUS	false
188.18.29.165	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
142.129.246.66	unknown	United States	20001	TWC-20001-PACWESTUS	false
120.80.86.53	unknown	China	136959	UNICOM-FUOSHAN-IDCChinaUnicomGuangdongIPnetworkCN	false
131.91.23.104	unknown	United States	12013	FAUNETUS	false
66.170.34.83	unknown	United States	13819	FWIN-NETUS	false
85.248.75.240	unknown	Slovakia (SLOVAK Republic)	5578	AS-BENESTRABratislavaSlovakRepublicSK	false
61.18.162.1	unknown	Hong Kong	9908	HKCABLE2-HK-APHKCableTVLtdHK	false
123.208.228.148	unknown	Australia	135887	TELSTRA-BELONG-APTelstraCorporationAU	false
192.93.77.60	unknown	France	2486	NIC-FR-DNS-UNICAST-PARIS2AFNICAssociationFrancaisepour	false
36.19.160.158	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
85.158.130.86	unknown	Bahrain	35019	BIX-ASBH	false
170.97.133.228	unknown	United States	18980	PEACEHEALTHUS	false
138.110.229.127	unknown	United States	396349	FIVE-COLLEGE-DATA-NETWORK-ASUS	false
68.160.78.219	unknown	United States	701	UUNETUS	false
171.239.43.136	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
109.104.184.92	unknown	Ukraine	31272	WILDPARK-ASISPWildParkUkraineNikolaevUA	false
64.89.118.185	unknown	United States	22561	CENTURYLINK-LEGACY-LIGHTCOREUS	false
79.56.216.235	unknown	Italy	3269	ASN-IBSNAZIT	false
83.254.183.0	unknown	Sweden	39651	COMHEM-SWEDENSE	false
91.234.104.229	unknown	France	198375	INU-ASFR	false
157.23.88.224	unknown	France	7091	VIANET-ASNUS	false
174.131.28.247	unknown	United States	7029	WINDSTREAMUS	false
37.105.183.24	unknown	Saudi Arabia	25019	SAUDINETSTC-ASSA	false
217.107.233.71	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
213.224.79.73	unknown	Belgium	6848	TELENET-ASBE	false
182.134.184.52	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
32.159.189.22	unknown	United States	2686	ATGS-MMD-ASUS	false
83.252.157.35	unknown	Sweden	39651	COMHEM-SWEDENSE	false
194.109.43.227	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
63.46.220.137	unknown	United States	22394	CELLCOUS	false
79.228.253.212	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
85.50.245.47	unknown	Spain	12479	UNI2-ASES	false
158.202.251.40	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
67.72.149.234	unknown	United States	3356	LEVEL3US	false
169.141.18.224	unknown	United States	18755	ASPECT-SERVICEUS	false
85.83.182.138	unknown	Denmark	9158	TELENOR_DANMARK_ASDK	false
71.197.132.77	unknown	United States	7922	COMCAST-7922US	false
164.110.2.61	unknown	United States	14827	WSDOT-ASNUS	false
164.77.93.239	unknown	Chile	6471	ENTELCHILESACL	false
163.95.244.205	unknown	France	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
74.1.244.63	unknown	United States	18566	MEGAPATH5-US	false
42.186.168.227	unknown	China	45062	NETEASE-ASGuangzhouNetEaseComputerSystemCoLtdCN	false
200.101.14.143	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
169.242.216.235	unknown	United States	47024	THE-METROHEALTH-SYSTEMUS	false
132.79.99.54	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
151.210.214.29	unknown	New Zealand	23655	SNAP-NZ-ASSnapInternetLimitedNZ	false
66.131.222.3	unknown	Canada	5769	VIDEOTRONCA	false
168.76.73.118	unknown	South Africa	265240	ULTRANETSERVICOSEMINTERNETLTDABR	false
170.15.228.31	unknown	United States	14145	REGIONS-ASN-3US	false
40.103.228.120	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
196.132.218.162	unknown	Egypt	36935	Vodafone-EG	false
170.53.225.230	unknown	United States	54640	CONEHEALTHUS	false
152.140.233.100	unknown	United States	45090	CNNIC-TENCENT-NET-APShenzhenTencentComputerSystemsCompa	false
86.59.61.204	unknown	Austria	8437	UTA-ASAT	false
65.137.246.8	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
45.166.117.100	unknown	Brazil	267956	FRANCISCOWESLEYGOMESFERREIRA-MEBR	false
48.6.234.139	unknown	United States	2686	ATGS-MMD-ASUS	false
190.206.236.129	unknown	Venezuela	8048	CANTVServiciosVenezuelaVE	false
112.246.102.215	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
77.109.170.17	unknown	Switzerland	13030	INIT7CH	false
148.172.3.84	unknown	United States	7068	PFIZERNETUS	false
197.3.15.230	unknown	Tunisia	37705	TOPNETTN	false
54.133.219.175	unknown	United States	14618	AMAZON-AESUS	false
63.156.139.168	unknown	United States	32996	AGRIBANK-STPAULUS	false
82.82.99.16	unknown	Germany	3209	VODANETInternationalIP-BackboneofVodafoneDE	false
53.211.81.177	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
90.192.73.218	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
82.49.77.25	unknown	Italy	3269	ASN-IBSNAZIT	false
218.44.142.114	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
136.163.179.238	unknown	Sweden	3301	TELIANET-SWEDENTeliaCompanySE	false
145.136.26.255	unknown	Netherlands	1103	SURFNET-NLSURFnetTheNetherlandsNL	false
113.61.96.6	unknown	Australia	38835	VIAIP-AS-APBuroservAustraliaPtyLtdAU	false
151.220.208.226	unknown	unknown	11003	PANDGUS	false
32.7.187.233	unknown	United States	2686	ATGS-MMD-ASUS	false
12.37.50.21	unknown	United States	7018	ATT-INTERNET4US	false
54.183.186.57	unknown	United States	16509	AMAZON-02US	false
118.79.220.170	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
198.66.73.172	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
14.245.58.162	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
89.152.12.33	unknown	Portugal	2860	NOS_COMUNICACOESPT	false
141.26.232.233	unknown	Germany	2857	RLP-NETDE	false
23.121.232.21	unknown	United States	7018	ATT-INTERNET4US	false
103.109.48.244	unknown	China	135937	NEXTTECH-AS-VNNextTechnologyInvestmentandDevelopmentCo	false
180.215.104.112	unknown	Singapore	64050	BCPL-SGBGPNETGlobalASNSG	false
184.249.10.104	unknown	United States	10507	SPCSUS	false

Contacted Domains

Name	IP	Active
www.cafk.ru	91.189.114.19	true
bebd.ru	185.137.235.2	true
www.ckea.ru	194.120.116.196	true
dlba.ru	194.58.112.174	true
leaa.ru	159.69.115.63	true
www.dack.ru	62.122.170.171	true
www.abcf.ru	62.122.170.171	true
aakl.ru	213.189.196.111	true
acfe.ru	62.122.170.171	true
dfca.ru	159.69.115.63	true
www.ablc.ru	31.31.205.163	true
ablc.ru	31.31.205.163	true
lb.bitrix24shop.ru	185.137.235.2	true
acak.ru	194.67.71.32	true
www.allk.ru	185.189.15.13	true
www.leaa.ru	159.69.115.63	true
kaad.ru	90.156.201.12	true
defc.ru	31.31.205.163	true
www.elld.ru	194.58.112.165	true
www.acak.ru	194.67.71.189	true
cdke.ru	91.193.180.124	true
www.acfe.ru	62.122.170.171	true
www.akda.ru	5.101.153.37	true
www.laea.ru	159.69.115.63	true
cafk.ru	91.189.114.19	true
abcf.ru	62.122.170.171	true
www.afee.ru	176.99.6.92	true
dack.ru	62.122.170.171	true
ckea.ru	45.159.211.121	true
clck.ru	213.180.204.221	true
eala.ru	195.24.68.6	true
cllk.ru	195.161.68.19	true
fabd.ru	94.26.228.204	true
afee.ru	176.99.6.92	true
lkbf.ru	212.164.86.2	true
www.cdke.ru	91.193.180.124	true
ldlc.ru	172.67.169.209	true
www.aakb.ru	194.58.112.174	true
daea.ru	159.69.115.63	true
www.leea.ru	31.31.205.31	true
dbda.ru	31.177.80.70	true
kaaf.ru	31.177.80.70	true
www.fakk.ru	194.58.112.165	true
www.clal.ru	62.122.170.171	true
laaa.ru	31.177.80.144	true
ekac.ru	62.122.170.171	true
www.caee.ru	159.69.115.63	true
www.eeca.ru	159.69.115.63	true
www.kfaf.ru	194.58.112.165	true
www.dkbk.ru	185.114.245.109	true
caal.ru	31.177.76.70	true
fdak.ru	5.23.50.56	true
clak.ru	62.122.170.171	true
daisy.ubuntu.com	162.213.35.25	true
www.aacd.ru	87.236.16.248	true
www.fafe.ru	31.31.205.163	true
allk.ru	185.189.15.13	true
kkfa.ru	91.189.114.18	true
www.dfca.ru	159.69.115.63	true
ccka.ru	31.177.80.70	true
elld.ru	194.58.112.165	true
www.cdlk.ru	188.114.96.3	true
www.ccea.ru	194.58.112.165	true
www.ceae.ru	31.31.198.188	true
www.clld.ru	194.58.112.173	true
deak.ru	31.177.80.70	true
www.beda.ru	62.122.170.171	true
www.cefk.ru	62.122.170.171	true
ecll.ru	31.177.80.70	true
aadf.ru	159.69.115.63	true
abeb.ru	31.31.205.163	true
cdlk.ru	188.114.96.3	true
www.addl.ru	62.122.170.171	true
akfk.ru	62.122.170.171	true
ccbd.ru	62.122.170.171	true
edla.ru	31.31.205.163	true
efad.ru	31.31.205.163	true
www.alad.ru	92.53.96.37	true
daaa.ru	5.182.5.87	true
www.ckda.ru	62.122.170.171	true
www.bebc.ru	185.135.82.191	true
www.akfk.ru	62.122.170.171	true
www.ekef.ru	31.31.205.163	true
www.fdak.ru	5.23.50.56	true
www.aadf.ru	159.69.115.63	true
www.klck.ru	46.254.19.206	true
www.lkbk.ru	54.185.169.30	true
www.edla.ru	31.31.205.163	true
www.eead.ru	194.58.112.165	true
www.eclf.ru	159.69.115.63	true
www.bekk.ru	62.122.170.171	true
adbf.ru	185.133.42.146	true
ckda.ru	62.122.170.171	true
bebc.ru	185.135.82.191	true
lkbk.ru	54.185.169.30	true
bffl.ru	31.177.80.70	true
www.cabl.ru	45.62.194.14	true
www.daaa.ru	5.182.5.87	true
alad.ru	92.53.96.37	true
www.fabd.ru	94.26.228.204	true

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://90.156.201.87/	false	Avira URL Cloud: safe	unknown
http://90.156.201.41/	false	Avira URL Cloud: safe	unknown
http://90.156.201.79/	false	Avira URL Cloud: safe	unknown
http://5.101.159.26/	false	Avira URL Cloud: safe	unknown
http://87.236.16.248/	false	Avira URL Cloud: safe	unknown
http://188.114.97.3/	false	Avira URL Cloud: safe	unknown
http://5.23.50.56/	false	Avira URL Cloud: safe	unknown
http://185.137.235.2/	false	Avira URL Cloud: safe	unknown
http://31.177.80.70/	false	Avira URL Cloud: safe	unknown
http://45.62.194.14/	false	Avira URL Cloud: safe	unknown
http://194.58.112.173/	false	Avira URL Cloud: safe	unknown
http://185.133.42.146/	false	Avira URL Cloud: safe	unknown
http://54.185.169.30/	false	Avira URL Cloud: safe	unknown
http://193.176.77.56/	false	Avira URL Cloud: safe	unknown
http://94.26.228.204/	false	Avira URL Cloud: safe	unknown
http://5.182.5.87/	false	Avira URL Cloud: safe	unknown
http://194.58.112.165/	false	Avira URL Cloud: safe	unknown
http://91.189.114.18/	false	Avira URL Cloud: safe	unknown
http://213.180.204.221/	false	Avira URL Cloud: safe	unknown
http://176.99.6.92/	false	Avira URL Cloud: safe	unknown
http://195.24.68.6/	false	Avira URL Cloud: safe	unknown
http://5.101.153.37/	false	Avira URL Cloud: safe	unknown
http://31.177.76.144/	false	Avira URL Cloud: safe	unknown
http://46.254.19.206/	false	Avira URL Cloud: safe	unknown
http://90.156.201.12/	false	Avira URL Cloud: safe	unknown
http://31.177.80.144/	false	Avira URL Cloud: safe	unknown
http://195.161.68.19/	false	Avira URL Cloud: safe	unknown
http://188.114.96.3/	false	Avira URL Cloud: safe	unknown
http://185.135.82.191/	false	Avira URL Cloud: safe	unknown
http://104.21.27.236/	false	Avira URL Cloud: safe	unknown
http://172.67.169.209/	false	Avira URL Cloud: safe	unknown
http://31.177.76.70/	false	Avira URL Cloud: safe	unknown
http://212.164.86.2/	false	Avira URL Cloud: safe	unknown
http://194.58.112.174/	false	Avira URL Cloud: safe	unknown
http://194.67.71.32/	false	Avira URL Cloud: safe	unknown
http://62.122.170.171/	false	Avira URL Cloud: safe	unknown
http://91.193.180.124/	false	Avira URL Cloud: safe	unknown
http://213.189.196.111/	false	Avira URL Cloud: safe	unknown
http://91.189.114.19/	false	Avira URL Cloud: safe	unknown
http://31.31.205.163/	false	Avira URL Cloud: safe	unknown
http://31.31.205.31/	false	Avira URL Cloud: safe	unknown
http://181.214.142.230/	false	Avira URL Cloud: safe	unknown
http://176.31.179.191/	false	Avira URL Cloud: safe	unknown
http://92.53.96.37/	false	Avira URL Cloud: safe	unknown
http://185.189.15.13/	false	Avira URL Cloud: safe	unknown
http://159.69.115.63/	false	Avira URL Cloud: safe	unknown
http://31.31.198.188/	false	Avira URL Cloud: safe	unknown

Name	Type	MD5	SHA1	SHA256
/etc/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/etc/d	ASCII text	A2008AA7FD38095DA61F27A3DC26254F	751CD5477FFEA4DA5C1FC4FE48DF20270918FC51	315E6991D91E2B4480F39A380E3B98D7C30B5E43061FE4C84D4770DBFFB2E373
/home/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/mnt/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/root/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/tmp/allah_is_prick.html	HTML document, ASCII text, with very long lines (11520), with no line terminators	5FDE87097AB31989263854B0DD4CD807	2A052A44E4DF8B48A6448D7C14A5A17B077476D2	919F9FAFBCFBDD200F2A0A7FEDDAB7F3D1320B2FA56A83BF9817E92191FB341B
/usr/bin/gpcwo	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped	307C851A7A0C4B7DD8AFD2ABD662480C	4E2B66521A16A174FCD6581357D289F1EDE59CB1	6D7A2A182467276297C8A84A5D2840E7EE335FB985F63CDA9E618B229973E1A2
/var/allah_is_prick.html	HTML document, ASCII text, with very long lines (360), with no line terminators	3A2D9EE3D20A76ED6AF3F066BE482B64	8EE4338DF17D6DBBD7CFEC1AA0ABBD6A7B8081F6	9D542210472A30C5142DF1F1AC2A25D72A453C5DFAD27B09F805691A2E936082
/var/spool/cron/crontabs/root	ASCII text	FF971B9F374D9D04E1E8FBE027B27C04	793D6F281C4AB25E3363954D390832FE97403B43	737F4B271D708B20B494467A4B3F03C5FA16CECD2A3BECF7FB4D653405377F9E
/var/spool/cron/crontabs/tmp.1Z62b3	ASCII text	8D5651FB2C53D187AC1052AC2E5D55E3	E550514741091889F735BE4892781AE7D1B0296A	FF20F0363B9FEB1F9617C8726C7FEAF8AA7D938DBC42FE0ABF2DEAD9B9EABEC3
/var/spool/cron/crontabs/tmp.nFhVQ3	ASCII text	8D5651FB2C53D187AC1052AC2E5D55E3	E550514741091889F735BE4892781AE7D1B0296A	FF20F0363B9FEB1F9617C8726C7FEAF8AA7D938DBC42FE0ABF2DEAD9B9EABEC3

AV Detection

Antivirus / Scanner detection for submitted sample

Source: firmware.i586.elf

Avira: detected

Antivirus detection for dropped file

Source: /usr/bin/gpcwo

Avira: detection malicious, Label: EXP/ELF.Mirai.L

Multi AV Scanner detection for submitted file

Source: firmware.i586.elf	ReversingLabs: Detection: 55%
Source: firmware.i586.elf	Virustotal: Detection: 56%			Perma Link

Machine Learning detection for dropped file

Source: /usr/bin/gpcwo

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: firmware.i586.elf

Joe Sandbox ML: detected

Networking

Tries to resolve many domain names, but no domain seems valid

Source: unknown	DNS traffic detected: query: eddf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bkaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fafl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aedb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kfae.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: llba.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: aaek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kcld.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bkaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ldcc.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.blkb.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: elbf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aclk.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fkke.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.dkdd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fkke.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: kfae.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.bffl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.effl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.abba.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.deak.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaaa.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.dkcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akak.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aaaa.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.fcaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kcek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.caal.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aaek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: acce.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.alaa.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.akak.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: kcek.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: akcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: fcaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bkaf.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.bkcd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.elcc.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aaaa.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: kcld.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: dkdd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.eddf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.elbf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: blkb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.ccka.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.cfkf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.lbaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kcld.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: effl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bdkb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.acce.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.aakd.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.ecll.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: lbaf.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: ldcc.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: clbl.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: lbaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cklb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aedb.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.llba.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: dkcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aclk.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: cfkf.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.kfae.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.dbda.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aedb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: aakd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.aakd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bkcd.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.kaaf.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bdab.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.bdkb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bdab.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.clbl.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.cllk.ru replaycode: Server failure (2)
Source: unknown	DNS traffic detected: query: www.cklb.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: www.akcl.ru replaycode: Name error (3)
Source: unknown	DNS traffic detected: query: bkaf.ru replaycode: Server failure (2)

Connects to many different domains

Source: unknown

Network traffic detected: DNS query count 227

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.13:60948 -> 48.46.49.0:8202
Source: global traffic	TCP traffic: 192.168.2.13:43514 -> 48.46.49.51:0
Source: global traffic	TCP traffic: 192.168.2.13:52340 -> 48.46.50.53:0
Source: global traffic	TCP traffic: 192.168.2.13:46482 -> 8.8.8.8:81

Executes massive DNS lookups (> 100)

Source: global traffic

DNS traffic detected: number of DNS queries: 227

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 54.185.169.30Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.180.204.221Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.182.5.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.67.71.32Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.161.68.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.198.188Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.254.19.206Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.99.6.92Connection: close

Source: unknown	TCP traffic detected without corresponding DNS query: 14.215.143.125
Source: unknown	TCP traffic detected without corresponding DNS query: 167.82.77.125
Source: unknown	TCP traffic detected without corresponding DNS query: 165.233.20.104
Source: unknown	TCP traffic detected without corresponding DNS query: 135.57.153.23
Source: unknown	TCP traffic detected without corresponding DNS query: 49.122.84.171
Source: unknown	TCP traffic detected without corresponding DNS query: 67.56.219.192
Source: unknown	TCP traffic detected without corresponding DNS query: 80.72.162.208
Source: unknown	TCP traffic detected without corresponding DNS query: 141.9.68.142
Source: unknown	TCP traffic detected without corresponding DNS query: 12.234.246.47
Source: unknown	TCP traffic detected without corresponding DNS query: 180.136.160.167
Source: unknown	TCP traffic detected without corresponding DNS query: 103.4.232.51
Source: unknown	TCP traffic detected without corresponding DNS query: 49.174.205.252
Source: unknown	TCP traffic detected without corresponding DNS query: 162.67.70.167
Source: unknown	TCP traffic detected without corresponding DNS query: 216.251.228.90
Source: unknown	TCP traffic detected without corresponding DNS query: 152.31.0.50
Source: unknown	TCP traffic detected without corresponding DNS query: 164.0.98.134
Source: unknown	TCP traffic detected without corresponding DNS query: 209.231.95.38
Source: unknown	TCP traffic detected without corresponding DNS query: 14.89.32.195
Source: unknown	TCP traffic detected without corresponding DNS query: 53.163.221.82
Source: unknown	TCP traffic detected without corresponding DNS query: 94.153.224.160
Source: unknown	TCP traffic detected without corresponding DNS query: 199.115.62.90
Source: unknown	TCP traffic detected without corresponding DNS query: 153.123.46.70
Source: unknown	TCP traffic detected without corresponding DNS query: 206.68.137.23
Source: unknown	TCP traffic detected without corresponding DNS query: 221.214.198.131
Source: unknown	TCP traffic detected without corresponding DNS query: 69.180.197.118
Source: unknown	TCP traffic detected without corresponding DNS query: 150.227.186.79
Source: unknown	TCP traffic detected without corresponding DNS query: 173.189.180.36
Source: unknown	TCP traffic detected without corresponding DNS query: 205.238.18.104
Source: unknown	TCP traffic detected without corresponding DNS query: 88.31.238.229
Source: unknown	TCP traffic detected without corresponding DNS query: 166.49.41.202
Source: unknown	TCP traffic detected without corresponding DNS query: 222.187.114.197
Source: unknown	TCP traffic detected without corresponding DNS query: 65.75.76.138
Source: unknown	TCP traffic detected without corresponding DNS query: 12.123.158.52
Source: unknown	TCP traffic detected without corresponding DNS query: 193.142.51.131
Source: unknown	TCP traffic detected without corresponding DNS query: 211.170.28.6
Source: unknown	TCP traffic detected without corresponding DNS query: 181.173.136.207
Source: unknown	TCP traffic detected without corresponding DNS query: 20.130.248.92
Source: unknown	TCP traffic detected without corresponding DNS query: 129.137.162.130
Source: unknown	TCP traffic detected without corresponding DNS query: 221.5.1.246
Source: unknown	TCP traffic detected without corresponding DNS query: 113.185.173.162
Source: unknown	TCP traffic detected without corresponding DNS query: 174.109.246.163
Source: unknown	TCP traffic detected without corresponding DNS query: 51.185.61.225
Source: unknown	TCP traffic detected without corresponding DNS query: 176.123.169.29
Source: unknown	TCP traffic detected without corresponding DNS query: 138.236.82.138
Source: unknown	TCP traffic detected without corresponding DNS query: 160.27.81.198
Source: unknown	TCP traffic detected without corresponding DNS query: 80.16.197.124
Source: unknown	TCP traffic detected without corresponding DNS query: 211.137.81.51
Source: unknown	TCP traffic detected without corresponding DNS query: 9.39.114.53
Source: unknown	TCP traffic detected without corresponding DNS query: 32.131.248.29
Source: unknown	TCP traffic detected without corresponding DNS query: 17.185.226.204

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 92.53.96.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.97.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 188.114.96.3Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.31Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.31.179.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.189.15.13Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.135.82.191Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.193.180.124Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 45.62.194.14Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.153.37Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 212.164.86.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 94.26.228.204Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 104.21.27.236Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 172.67.169.209Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 54.185.169.30Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 87.236.16.248Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.41Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.79Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.12Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 90.156.201.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.101.159.26Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.189.196.111Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.173Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 213.180.204.221Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.144Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 181.214.142.230Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.133.42.146Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.23.50.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 91.189.114.18Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.24.68.6Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 5.182.5.87Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.137.235.2Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 193.176.77.56Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.165Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.67.71.32Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 195.161.68.19Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.80.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.177.76.70Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 194.58.112.174Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.205.163Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 31.31.198.188Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 46.254.19.206Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 159.69.115.63Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 62.122.170.171Connection: close
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 176.99.6.92Connection: close

Source: global traffic	DNS traffic detected: DNS query: akak.ru
Source: global traffic	DNS traffic detected: DNS query: www.akak.ru
Source: global traffic	DNS traffic detected: DNS query: ekac.ru
Source: global traffic	DNS traffic detected: DNS query: www.ekac.ru
Source: global traffic	DNS traffic detected: DNS query: fafe.ru
Source: global traffic	DNS traffic detected: DNS query: www.fafe.ru
Source: global traffic	DNS traffic detected: DNS query: ckea.ru
Source: global traffic	DNS traffic detected: DNS query: www.ckea.ru
Source: global traffic	DNS traffic detected: DNS query: fkke.ru
Source: global traffic	DNS traffic detected: DNS query: www.fkke.ru
Source: global traffic	DNS traffic detected: DNS query: leea.ru
Source: global traffic	DNS traffic detected: DNS query: www.leea.ru
Source: global traffic	DNS traffic detected: DNS query: alad.ru
Source: global traffic	DNS traffic detected: DNS query: www.alad.ru
Source: global traffic	DNS traffic detected: DNS query: ccbd.ru
Source: global traffic	DNS traffic detected: DNS query: www.ccbd.ru
Source: global traffic	DNS traffic detected: DNS query: cdlk.ru
Source: global traffic	DNS traffic detected: DNS query: www.cdlk.ru
Source: global traffic	DNS traffic detected: DNS query: kcld.ru
Source: global traffic	DNS traffic detected: DNS query: www.kcld.ru
Source: global traffic	DNS traffic detected: DNS query: addl.ru
Source: global traffic	DNS traffic detected: DNS query: www.addl.ru
Source: global traffic	DNS traffic detected: DNS query: dack.ru
Source: global traffic	DNS traffic detected: DNS query: www.dack.ru
Source: global traffic	DNS traffic detected: DNS query: eclf.ru
Source: global traffic	DNS traffic detected: DNS query: www.eclf.ru
Source: global traffic	DNS traffic detected: DNS query: clak.ru
Source: global traffic	DNS traffic detected: DNS query: www.clak.ru
Source: global traffic	DNS traffic detected: DNS query: acad.ru
Source: global traffic	DNS traffic detected: DNS query: www.acad.ru
Source: global traffic	DNS traffic detected: DNS query: alaa.ru
Source: global traffic	DNS traffic detected: DNS query: www.alaa.ru
Source: global traffic	DNS traffic detected: DNS query: edla.ru
Source: global traffic	DNS traffic detected: DNS query: www.edla.ru
Source: global traffic	DNS traffic detected: DNS query: aedb.ru
Source: global traffic	DNS traffic detected: DNS query: www.aedb.ru
Source: global traffic	DNS traffic detected: DNS query: aakd.ru
Source: global traffic	DNS traffic detected: DNS query: www.aakd.ru
Source: global traffic	DNS traffic detected: DNS query: abba.ru
Source: global traffic	DNS traffic detected: DNS query: www.abba.ru
Source: global traffic	DNS traffic detected: DNS query: ckda.ru
Source: global traffic	DNS traffic detected: DNS query: www.ckda.ru
Source: global traffic	DNS traffic detected: DNS query: allk.ru
Source: global traffic	DNS traffic detected: DNS query: www.allk.ru
Source: global traffic	DNS traffic detected: DNS query: kfaf.ru
Source: global traffic	DNS traffic detected: DNS query: www.kfaf.ru
Source: global traffic	DNS traffic detected: DNS query: bebc.ru
Source: global traffic	DNS traffic detected: DNS query: www.bebc.ru
Source: global traffic	DNS traffic detected: DNS query: daea.ru
Source: global traffic	DNS traffic detected: DNS query: www.daea.ru
Source: global traffic	DNS traffic detected: DNS query: cdke.ru
Source: global traffic	DNS traffic detected: DNS query: www.cdke.ru
Source: global traffic	DNS traffic detected: DNS query: deak.ru
Source: global traffic	DNS traffic detected: DNS query: www.deak.ru
Source: global traffic	DNS traffic detected: DNS query: caee.ru
Source: global traffic	DNS traffic detected: DNS query: www.caee.ru
Source: global traffic	DNS traffic detected: DNS query: cafk.ru
Source: global traffic	DNS traffic detected: DNS query: www.cafk.ru
Source: global traffic	DNS traffic detected: DNS query: cabl.ru
Source: global traffic	DNS traffic detected: DNS query: www.cabl.ru
Source: global traffic	DNS traffic detected: DNS query: akda.ru
Source: global traffic	DNS traffic detected: DNS query: www.akda.ru
Source: global traffic	DNS traffic detected: DNS query: kfae.ru
Source: global traffic	DNS traffic detected: DNS query: www.kfae.ru
Source: global traffic	DNS traffic detected: DNS query: effl.ru
Source: global traffic	DNS traffic detected: DNS query: www.effl.ru
Source: global traffic	DNS traffic detected: DNS query: bkaf.ru
Source: global traffic	DNS traffic detected: DNS query: www.bkaf.ru
Source: global traffic	DNS traffic detected: DNS query: dlba.ru
Source: global traffic	DNS traffic detected: DNS query: www.dlba.ru
Source: global traffic	DNS traffic detected: DNS query: lkbf.ru
Source: global traffic	DNS traffic detected: DNS query: www.lkbf.ru
Source: global traffic	DNS traffic detected: DNS query: fabd.ru
Source: global traffic	DNS traffic detected: DNS query: www.fabd.ru
Source: global traffic	DNS traffic detected: DNS query: ldlc.ru
Source: global traffic	DNS traffic detected: DNS query: www.ldlc.ru
Source: global traffic	DNS traffic detected: DNS query: dfca.ru
Source: global traffic	DNS traffic detected: DNS query: www.dfca.ru
Source: global traffic	DNS traffic detected: DNS query: ccka.ru
Source: global traffic	DNS traffic detected: DNS query: www.ccka.ru
Source: global traffic	DNS traffic detected: DNS query: kaaf.ru
Source: global traffic	DNS traffic detected: DNS query: www.kaaf.ru
Source: global traffic	DNS traffic detected: DNS query: bdab.ru
Source: global traffic	DNS traffic detected: DNS query: www.bdab.ru
Source: global traffic	DNS traffic detected: DNS query: aacd.ru
Source: global traffic	DNS traffic detected: DNS query: www.aacd.ru
Source: global traffic	DNS traffic detected: DNS query: lkbk.ru
Source: global traffic	DNS traffic detected: DNS query: www.lkbk.ru
Source: global traffic	DNS traffic detected: DNS query: fakk.ru
Source: global traffic	DNS traffic detected: DNS query: www.fakk.ru
Source: global traffic	DNS traffic detected: DNS query: kaad.ru
Source: global traffic	DNS traffic detected: DNS query: www.kaad.ru
Source: global traffic	DNS traffic detected: DNS query: ecll.ru
Source: global traffic	DNS traffic detected: DNS query: www.ecll.ru
Source: global traffic	DNS traffic detected: DNS query: afea.ru
Source: global traffic	DNS traffic detected: DNS query: www.afea.ru
Source: global traffic	DNS traffic detected: DNS query: aakl.ru
Source: global traffic	DNS traffic detected: DNS query: www.aakl.ru
Source: global traffic	DNS traffic detected: DNS query: kcek.ru
Source: global traffic	DNS traffic detected: DNS query: www.kcek.ru

System Summary

Malicious sample detected (through community Yara rule)

Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: dropped/gpcwo, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Yara signature match

Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: firmware.i586.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5764.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5768.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 5767.1.0000000008048000.000000000805f000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: dropped/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: dropped/gpcwo, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: /usr/bin/gpcwo, type: DROPPED	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal96.troj.evad.linELF@0/24@1251/0

Persistence and Installation Behavior

Executes the "crontab" command typically for achieving persistence

Source: /bin/sh (PID: 5791)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior
Source: /bin/sh (PID: 5790)	Crontab executable: /usr/bin/crontab -> crontab /var/spool/cron/crontabs/root			Jump to behavior

Sample tries to persist itself using cron

Source: /tmp/firmware.i586.elf (PID: 5767)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5768)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 5791)	File: /var/spool/cron/crontabs/tmp.nFhVQ3	Jump to behavior
Source: /usr/bin/crontab (PID: 5791)	File: /var/spool/cron/crontabs/root	Jump to behavior
Source: /usr/bin/crontab (PID: 5790)	File: /var/spool/cron/crontabs/tmp.1Z62b3	Jump to behavior
Source: /usr/bin/crontab (PID: 5790)	File: /var/spool/cron/crontabs/root	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/firmware.i586.elf (PID: 5778)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5821)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5848)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5857)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5865)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5878)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5886)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5892)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5929)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5937)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5948)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5957)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5783)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5794)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5798)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5789)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5777)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5819)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5846)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5855)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5863)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5873)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5882)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5925)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5935)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5946)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5955)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5781)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5792)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5796)	Shell command executed: sh -c "hostname -I"	Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5788)	Shell command executed: sh -c "crontab /var/spool/cron/crontabs/root"	Jump to behavior

Executes the "hostname" command used to retrieve the computers name

Source: /bin/sh (PID: 5786)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5822)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5849)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5858)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5866)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5879)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5887)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5893)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5930)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5938)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5949)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5958)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5787)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5795)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5799)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5784)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5820)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5847)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5856)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5864)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5874)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5883)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5926)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5936)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5947)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5956)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5785)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5793)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior
Source: /bin/sh (PID: 5797)	Hostname executable: /usr/bin/hostname -> hostname -I	Jump to behavior

Sample tries to set the executable flag

Source: /tmp/firmware.i586.elf (PID: 5767)	File: /bin/gpcwo (bits: - usr: rx grp: rx all: rwx)			Jump to behavior
Source: /tmp/firmware.i586.elf (PID: 5768)	File: /bin/gpcwo (bits: - usr: rx grp: rx all: rwx)			Jump to behavior

Writes ELF files to disk

Source: /tmp/firmware.i586.elf (PID: 5767)	File written: /usr/bin/gpcwo
Source: /tmp/firmware.i586.elf (PID: 5768)	File written: /usr/bin/gpcwo			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/firmware.i586.elf (PID: 5767)	File: /usr/bin/gpcwo
Source: /tmp/firmware.i586.elf (PID: 5768)	File: /usr/bin/gpcwo			Jump to dropped file

ID:	1502463
Product:	CloudBasic
Start time:	17:40:00
Start date:	01.09.2024
Sample:	firmware.i586.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	307c851a7a0c4b7dd8afd2abd662480c
SHA1:	4e2b66521a16a174fcd6581357d289f1ede59cb1
SHA256:	6d7a2a182467276297c8a84a5d2840e7ee335fb985f63cda9e618b229973e1a2
Filetype:	ELF Executable and Linkable format (Linux) (4029/14) 50.16%

Linux Analysis Report firmware.i586.elf

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report
firmware.i586.elf