172.16.196.132 -> 172.16.183.2: Length 422 Command was case 1 -- Configuration. Using random target addresses IP address for skip: 203.173.144.35 172.16.196.132 -> 172.16.183.2: Length 422 Command was case 1 -- Configuration. Using random target addresses IP address for skip: 203.173.144.35 172.16.196.132 -> 172.16.183.2: Length 422 Command was case 1 -- Configuration. Using random target addresses IP address for skip: 203.173.144.35 172.16.196.132 -> 172.16.183.2: Length 422 Command was case 2 -- Execute command. requested command was 'rpcinfo -p 127.0.0.1' 172.16.183.2 -> 109.197.191.34: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 126.85.250.183: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 233.96.38.22: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 210.13.117.98: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 219.93.216.82: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 203.173.144.35: Length 500 Zombie reply: ** actual destination ** program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 41.230.157.197: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 20.17.169.129: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 214.104.164.84: Length 500 Zombie reply: fake destination program vers proto port 100000 2 tcp 111 portmapper 100000 2 udp 111 portmapper 100021 1 udp 1024 nlockmgr 100021 3 udp 1024 nlockmgr 100021 1 tcp 1024 nlockmgr 100021 3 tcp 1024 nlockmgr 100024 1 udp 924 status 100024 1 tcp 926 status 172.16.183.2 -> 109.197.191.34: Length 603 Zombie reply: fake destination 172.16.183.2 -> 126.85.250.183: Length 603 Zombie reply: fake destination 172.16.183.2 -> 233.96.38.22: Length 603 Zombie reply: fake destination 172.16.183.2 -> 210.13.117.98: Length 603 Zombie reply: fake destination 172.16.183.2 -> 219.93.216.82: Length 603 Zombie reply: fake destination 172.16.183.2 -> 203.173.144.35: Length 603 Zombie reply: ** actual destination ** 172.16.183.2 -> 41.230.157.197: Length 603 Zombie reply: fake destination 172.16.183.2 -> 20.17.169.129: Length 603 Zombie reply: fake destination 172.16.183.2 -> 214.104.164.84: Length 603 Zombie reply: fake destination