Edit tour

Linux Analysis Report
C.Linux.elf

Overview

General Information

Sample name:	C.Linux.elf
Analysis ID:	1376034
MD5:	56cabcf95add39a6feb09391ccc40dcd
SHA1:	84c8921f18a6d7861e842e4edb9c0c96142b5f75
SHA256:	4e153342189a55ffed34a91f2a3f4440af1acbf7dc58135a165a06b4e657556a
Tags:	elfGolangKuiperRansomwareVersionC
Infos:

Detection

Score:	68
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Creates a notice file (html or txt) to demand a ransom

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Executes commands using a shell command-line interpreter

Executes the "find" command together with an exec argument (might be indicative for ransomware)

Executes the "grep" command used to find patterns in files or piped streams

Executes the "mkdir" command used to create folders

Executes the "rm" command used to delete files or directories

Executes the "touch" command used to create files or modify time stamps

Sample has stripped symbol table

Sample tries to set the executable flag

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Writes shell script file to disk with an unusual file extension

Classification

Analysis Advice

All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work.

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1376034
Start date and time:	2024-01-17 14:23:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 32s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	C.Linux.elf
Detection:	MAL
Classification:	mal68.rans.troj.evad.linELF@0/61@0/0

Warnings

Connection to analysis system has been lost, crash info: Unknown

Runtime Messages

Command:	/tmp/C.Linux.elf
PID:	6222
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	open .ICE-unix/1477: no such device or address open .ICE-unix/1900: no such device or address open .X11-unix/X0: no such device or address open .X11-unix/X1: no such device or address open ssh-hOQ5FjG2iVgO/agent.1900: no such device or address reboot
Standard Error:	2024/01/17 14:23:42 number of processor cores 2 2024/01/17 14:23:42 rsa token size 1515 2024/01/17 14:23:42 all file pools started.. 2024/01/17 14:23:42 scanning all files on /tmp 2024/01/17 14:23:42 crypted: .xfsm-ICE-S33I80 2024/01/17 14:23:42 crypted: config-err-dHT8bZ 2024/01/17 14:23:42 crypted: dmesgtail.log 2024/01/17 14:23:42 all file pools stoped.. 2024/01/17 14:23:42 encryption sucess, done after time: 154.939877ms 2024/01/17 14:23:48 clean memory .. done

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6187, Parent: 4331)

cat (PID: 6187, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.YcTDHHOxSx

dash New Fork (PID: 6188, Parent: 4331)

head (PID: 6188, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6189, Parent: 4331)

tr (PID: 6189, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6190, Parent: 4331)

cut (PID: 6190, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6191, Parent: 4331)

cat (PID: 6191, Parent: 4331, MD5: 7e9d213e404ad3bb82e4ebb2e1f2c1b3) Arguments: cat /tmp/tmp.YcTDHHOxSx

dash New Fork (PID: 6192, Parent: 4331)

head (PID: 6192, Parent: 4331, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -n 10

dash New Fork (PID: 6193, Parent: 4331)

tr (PID: 6193, Parent: 4331, MD5: fbd1402dd9f72d8ebfff00ce7c3a7bb5) Arguments: tr -d \\000-\\011\\013\\014\\016-\\037

dash New Fork (PID: 6194, Parent: 4331)

cut (PID: 6194, Parent: 4331, MD5: d8ed0ea8f22c0de0f8692d4d9f1759d3) Arguments: cut -c -80

dash New Fork (PID: 6196, Parent: 4331)

rm (PID: 6196, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.YcTDHHOxSx /tmp/tmp.W99M6ZYVV2 /tmp/tmp.g2R2JSgaM5

C.Linux.elf (PID: 6222, Parent: 6111, MD5: 56cabcf95add39a6feb09391ccc40dcd) Arguments: /tmp/C.Linux.elf

C.Linux.elf New Fork (PID: 6229, Parent: 6222)

bash (PID: 6229, Parent: 6222, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /bin/bash -c reboot

reboot (PID: 6229, Parent: 6222, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: reboot

systemd New Fork (PID: 6232, Parent: 1)

blkdeactivate (PID: 6232, Parent: 1, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: /sbin/blkdeactivate -u -l wholevg -m disablequeueing -r wait

blkdeactivate New Fork (PID: 6278, Parent: 6232)

umount (PID: 6278, Parent: 6232, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount --help

blkdeactivate New Fork (PID: 6279, Parent: 6232)

grep (PID: 6279, Parent: 6232, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -- --all-targets

blkdeactivate New Fork (PID: 6291, Parent: 6232)

blkdeactivate New Fork (PID: 6293, Parent: 6291)

multipathd (PID: 6293, Parent: 6291, MD5: 73aecbc1c62d72893930e27aa30e66c2) Arguments: /sbin/multipathd show daemon

blkdeactivate New Fork (PID: 6292, Parent: 6232)

grep (PID: 6292, Parent: 6232, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep running

blkdeactivate New Fork (PID: 6295, Parent: 6232)

blkdeactivate New Fork (PID: 6296, Parent: 6295)

lsblk (PID: 6296, Parent: 6295, MD5: eb614bb92db49ab9302993bd61d540d6) Arguments: /bin/lsblk -r --noheadings -o TYPE,KNAME,NAME,MOUNTPOINT

blkdeactivate New Fork (PID: 6297, Parent: 6295)

sort (PID: 6297, Parent: 6295, MD5: 136279fed8a4d8534d55595f803dbd74) Arguments: /usr/bin/sort -r -u -k 4

blkdeactivate New Fork (PID: 6323, Parent: 6232)

lsblk (PID: 6323, Parent: 6232, MD5: eb614bb92db49ab9302993bd61d540d6) Arguments: /bin/lsblk -r --noheadings -o TYPE,KNAME,NAME,MOUNTPOINT -s

systemd New Fork (PID: 6233, Parent: 1)

finalrd (PID: 6233, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/bin/finalrd

finalrd New Fork (PID: 6272, Parent: 6233)

mount (PID: 6272, Parent: 6233, MD5: 92b20aa8b155ecd3ba9414aa477ef565) Arguments: mount -o remount,exec /run

finalrd New Fork (PID: 6287, Parent: 6233)

finalrd New Fork (PID: 6289, Parent: 6287)

grep (PID: 6289, Parent: 6287, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -Eow /.*ld-.*.so /proc/self/maps

finalrd New Fork (PID: 6290, Parent: 6287)

head (PID: 6290, Parent: 6287, MD5: fd96a67145172477dd57131396fc9608) Arguments: head -1

finalrd New Fork (PID: 6294, Parent: 6233)

rm (PID: 6294, Parent: 6233, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /run/finalrd-libs.conf

finalrd New Fork (PID: 6298, Parent: 6233)

touch (PID: 6298, Parent: 6233, MD5: 3859c173f5d3b37be3e531b7c84a9c68) Arguments: touch /run/finalrd-libs.conf

finalrd New Fork (PID: 6299, Parent: 6233)

finalrd New Fork (PID: 6300, Parent: 6299)

ld-2.31.so (PID: 6300, Parent: 6299, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /usr/lib/x86_64-linux-gnu/ld-2.31.so --list /bin/sh

finalrd New Fork (PID: 6301, Parent: 6299)

grep (PID: 6301, Parent: 6299, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -Eow "/.* "

finalrd New Fork (PID: 6305, Parent: 6233)

grep (PID: 6305, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libc.so.6 /run/finalrd-libs.conf

finalrd New Fork (PID: 6308, Parent: 6233)

dirname (PID: 6308, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libc.so.6

finalrd New Fork (PID: 6309, Parent: 6233)

realpath (PID: 6309, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libc.so.6

finalrd New Fork (PID: 6310, Parent: 6233)

readlink (PID: 6310, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libc.so.6

finalrd New Fork (PID: 6311, Parent: 6233)

grep (PID: 6311, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib64/ld-linux-x86-64.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6313, Parent: 6233)

dirname (PID: 6313, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib64/ld-linux-x86-64.so.2

finalrd New Fork (PID: 6314, Parent: 6233)

realpath (PID: 6314, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib64/ld-linux-x86-64.so.2

finalrd New Fork (PID: 6317, Parent: 6233)

readlink (PID: 6317, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib64/ld-linux-x86-64.so.2

finalrd New Fork (PID: 6321, Parent: 6233)

grep (PID: 6321, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /usr/lib/x86_64-linux-gnu/ld-2.31.so /run/finalrd-libs.conf

finalrd New Fork (PID: 6324, Parent: 6233)

rm (PID: 6324, Parent: 6233, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /run/finalrd-libs.conf

finalrd New Fork (PID: 6325, Parent: 6233)

touch (PID: 6325, Parent: 6233, MD5: 3859c173f5d3b37be3e531b7c84a9c68) Arguments: touch /run/finalrd-libs.conf

finalrd New Fork (PID: 6326, Parent: 6233)

finalrd New Fork (PID: 6327, Parent: 6326)

ld-2.31.so (PID: 6327, Parent: 6326, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /usr/lib/x86_64-linux-gnu/ld-2.31.so --list /lib/systemd/systemd-shutdown

finalrd New Fork (PID: 6328, Parent: 6326)

grep (PID: 6328, Parent: 6326, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -Eow "/.* "

finalrd New Fork (PID: 6329, Parent: 6233)

grep (PID: 6329, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libc.so.6 /run/finalrd-libs.conf

finalrd New Fork (PID: 6331, Parent: 6233)

dirname (PID: 6331, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libc.so.6

finalrd New Fork (PID: 6332, Parent: 6233)

realpath (PID: 6332, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libc.so.6

finalrd New Fork (PID: 6333, Parent: 6233)

readlink (PID: 6333, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libc.so.6

finalrd New Fork (PID: 6334, Parent: 6233)

grep (PID: 6334, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/systemd/libsystemd-shared-245.so /run/finalrd-libs.conf

finalrd New Fork (PID: 6335, Parent: 6233)

dirname (PID: 6335, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/systemd/libsystemd-shared-245.so

finalrd New Fork (PID: 6336, Parent: 6233)

grep (PID: 6336, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libmount.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6337, Parent: 6233)

dirname (PID: 6337, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libmount.so.1

finalrd New Fork (PID: 6338, Parent: 6233)

realpath (PID: 6338, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libmount.so.1

finalrd New Fork (PID: 6339, Parent: 6233)

readlink (PID: 6339, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libmount.so.1

finalrd New Fork (PID: 6340, Parent: 6233)

grep (PID: 6340, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib64/ld-linux-x86-64.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6341, Parent: 6233)

dirname (PID: 6341, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib64/ld-linux-x86-64.so.2

finalrd New Fork (PID: 6342, Parent: 6233)

realpath (PID: 6342, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib64/ld-linux-x86-64.so.2

finalrd New Fork (PID: 6343, Parent: 6233)

readlink (PID: 6343, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib64/ld-linux-x86-64.so.2

finalrd New Fork (PID: 6344, Parent: 6233)

grep (PID: 6344, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /usr/lib/x86_64-linux-gnu/ld-2.31.so /run/finalrd-libs.conf

finalrd New Fork (PID: 6345, Parent: 6233)

grep (PID: 6345, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libacl.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6346, Parent: 6233)

dirname (PID: 6346, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libacl.so.1

finalrd New Fork (PID: 6347, Parent: 6233)

realpath (PID: 6347, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libacl.so.1

finalrd New Fork (PID: 6348, Parent: 6233)

readlink (PID: 6348, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libacl.so.1

finalrd New Fork (PID: 6349, Parent: 6233)

grep (PID: 6349, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libblkid.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6350, Parent: 6233)

dirname (PID: 6350, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libblkid.so.1

finalrd New Fork (PID: 6351, Parent: 6233)

realpath (PID: 6351, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libblkid.so.1

finalrd New Fork (PID: 6352, Parent: 6233)

readlink (PID: 6352, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libblkid.so.1

finalrd New Fork (PID: 6353, Parent: 6233)

grep (PID: 6353, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libcap.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6354, Parent: 6233)

dirname (PID: 6354, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libcap.so.2

finalrd New Fork (PID: 6355, Parent: 6233)

realpath (PID: 6355, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libcap.so.2

finalrd New Fork (PID: 6356, Parent: 6233)

readlink (PID: 6356, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libcap.so.2

finalrd New Fork (PID: 6357, Parent: 6233)

grep (PID: 6357, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libcrypt.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6358, Parent: 6233)

dirname (PID: 6358, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libcrypt.so.1

finalrd New Fork (PID: 6359, Parent: 6233)

realpath (PID: 6359, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libcrypt.so.1

finalrd New Fork (PID: 6360, Parent: 6233)

readlink (PID: 6360, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libcrypt.so.1

finalrd New Fork (PID: 6361, Parent: 6233)

grep (PID: 6361, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libcryptsetup.so.12 /run/finalrd-libs.conf

finalrd New Fork (PID: 6362, Parent: 6233)

dirname (PID: 6362, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libcryptsetup.so.12

finalrd New Fork (PID: 6363, Parent: 6233)

realpath (PID: 6363, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libcryptsetup.so.12

finalrd New Fork (PID: 6364, Parent: 6233)

readlink (PID: 6364, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libcryptsetup.so.12

finalrd New Fork (PID: 6365, Parent: 6233)

grep (PID: 6365, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libgcrypt.so.20 /run/finalrd-libs.conf

finalrd New Fork (PID: 6366, Parent: 6233)

dirname (PID: 6366, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libgcrypt.so.20

finalrd New Fork (PID: 6367, Parent: 6233)

realpath (PID: 6367, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libgcrypt.so.20

finalrd New Fork (PID: 6368, Parent: 6233)

readlink (PID: 6368, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libgcrypt.so.20

finalrd New Fork (PID: 6369, Parent: 6233)

grep (PID: 6369, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libidn2.so.0 /run/finalrd-libs.conf

finalrd New Fork (PID: 6370, Parent: 6233)

dirname (PID: 6370, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libidn2.so.0

finalrd New Fork (PID: 6371, Parent: 6233)

realpath (PID: 6371, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libidn2.so.0

finalrd New Fork (PID: 6372, Parent: 6233)

readlink (PID: 6372, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libidn2.so.0

finalrd New Fork (PID: 6373, Parent: 6233)

grep (PID: 6373, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libip4tc.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6374, Parent: 6233)

dirname (PID: 6374, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libip4tc.so.2

finalrd New Fork (PID: 6375, Parent: 6233)

realpath (PID: 6375, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libip4tc.so.2

finalrd New Fork (PID: 6376, Parent: 6233)

readlink (PID: 6376, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libip4tc.so.2

finalrd New Fork (PID: 6377, Parent: 6233)

grep (PID: 6377, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libkmod.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6378, Parent: 6233)

dirname (PID: 6378, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libkmod.so.2

finalrd New Fork (PID: 6379, Parent: 6233)

realpath (PID: 6379, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libkmod.so.2

finalrd New Fork (PID: 6380, Parent: 6233)

readlink (PID: 6380, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libkmod.so.2

finalrd New Fork (PID: 6381, Parent: 6233)

grep (PID: 6381, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/liblz4.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6382, Parent: 6233)

dirname (PID: 6382, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/liblz4.so.1

finalrd New Fork (PID: 6383, Parent: 6233)

realpath (PID: 6383, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/liblz4.so.1

finalrd New Fork (PID: 6384, Parent: 6233)

readlink (PID: 6384, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/liblz4.so.1

finalrd New Fork (PID: 6385, Parent: 6233)

grep (PID: 6385, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libpam.so.0 /run/finalrd-libs.conf

finalrd New Fork (PID: 6386, Parent: 6233)

dirname (PID: 6386, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libpam.so.0

finalrd New Fork (PID: 6387, Parent: 6233)

realpath (PID: 6387, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libpam.so.0

finalrd New Fork (PID: 6388, Parent: 6233)

readlink (PID: 6388, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libpam.so.0

finalrd New Fork (PID: 6389, Parent: 6233)

grep (PID: 6389, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/librt.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6390, Parent: 6233)

dirname (PID: 6390, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/librt.so.1

finalrd New Fork (PID: 6391, Parent: 6233)

realpath (PID: 6391, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/librt.so.1

finalrd New Fork (PID: 6392, Parent: 6233)

readlink (PID: 6392, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/librt.so.1

finalrd New Fork (PID: 6393, Parent: 6233)

grep (PID: 6393, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libseccomp.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6394, Parent: 6233)

dirname (PID: 6394, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libseccomp.so.2

finalrd New Fork (PID: 6395, Parent: 6233)

realpath (PID: 6395, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libseccomp.so.2

finalrd New Fork (PID: 6396, Parent: 6233)

readlink (PID: 6396, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libseccomp.so.2

finalrd New Fork (PID: 6397, Parent: 6233)

grep (PID: 6397, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libselinux.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6398, Parent: 6233)

dirname (PID: 6398, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libselinux.so.1

finalrd New Fork (PID: 6399, Parent: 6233)

grep (PID: 6399, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/liblzma.so.5 /run/finalrd-libs.conf

finalrd New Fork (PID: 6400, Parent: 6233)

dirname (PID: 6400, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/liblzma.so.5

finalrd New Fork (PID: 6403, Parent: 6233)

realpath (PID: 6403, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/liblzma.so.5

finalrd New Fork (PID: 6404, Parent: 6233)

readlink (PID: 6404, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/liblzma.so.5

finalrd New Fork (PID: 6405, Parent: 6233)

grep (PID: 6405, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libpthread.so.0 /run/finalrd-libs.conf

finalrd New Fork (PID: 6406, Parent: 6233)

dirname (PID: 6406, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libpthread.so.0

finalrd New Fork (PID: 6407, Parent: 6233)

realpath (PID: 6407, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libpthread.so.0

finalrd New Fork (PID: 6408, Parent: 6233)

readlink (PID: 6408, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libpthread.so.0

finalrd New Fork (PID: 6409, Parent: 6233)

grep (PID: 6409, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libuuid.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6410, Parent: 6233)

dirname (PID: 6410, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libuuid.so.1

finalrd New Fork (PID: 6411, Parent: 6233)

realpath (PID: 6411, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libuuid.so.1

finalrd New Fork (PID: 6412, Parent: 6233)

readlink (PID: 6412, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libuuid.so.1

finalrd New Fork (PID: 6413, Parent: 6233)

grep (PID: 6413, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6414, Parent: 6233)

dirname (PID: 6414, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libdevmapper.so.1.02.1

finalrd New Fork (PID: 6415, Parent: 6233)

grep (PID: 6415, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libcrypto.so.1.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6416, Parent: 6233)

dirname (PID: 6416, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libcrypto.so.1.1

finalrd New Fork (PID: 6417, Parent: 6233)

grep (PID: 6417, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libargon2.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6418, Parent: 6233)

dirname (PID: 6418, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libargon2.so.1

finalrd New Fork (PID: 6419, Parent: 6233)

grep (PID: 6419, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libjson-c.so.4 /run/finalrd-libs.conf

finalrd New Fork (PID: 6420, Parent: 6233)

dirname (PID: 6420, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libjson-c.so.4

finalrd New Fork (PID: 6421, Parent: 6233)

realpath (PID: 6421, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libjson-c.so.4

finalrd New Fork (PID: 6422, Parent: 6233)

readlink (PID: 6422, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libjson-c.so.4

finalrd New Fork (PID: 6423, Parent: 6233)

grep (PID: 6423, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libgpg-error.so.0 /run/finalrd-libs.conf

finalrd New Fork (PID: 6424, Parent: 6233)

dirname (PID: 6424, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libgpg-error.so.0

finalrd New Fork (PID: 6425, Parent: 6233)

realpath (PID: 6425, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libgpg-error.so.0

finalrd New Fork (PID: 6426, Parent: 6233)

readlink (PID: 6426, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libgpg-error.so.0

finalrd New Fork (PID: 6427, Parent: 6233)

grep (PID: 6427, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libunistring.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6428, Parent: 6233)

dirname (PID: 6428, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libunistring.so.2

finalrd New Fork (PID: 6429, Parent: 6233)

realpath (PID: 6429, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libunistring.so.2

finalrd New Fork (PID: 6430, Parent: 6233)

readlink (PID: 6430, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libunistring.so.2

finalrd New Fork (PID: 6431, Parent: 6233)

grep (PID: 6431, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libaudit.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6432, Parent: 6233)

dirname (PID: 6432, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libaudit.so.1

finalrd New Fork (PID: 6433, Parent: 6233)

realpath (PID: 6433, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libaudit.so.1

finalrd New Fork (PID: 6434, Parent: 6233)

readlink (PID: 6434, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libaudit.so.1

finalrd New Fork (PID: 6435, Parent: 6233)

grep (PID: 6435, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libdl.so.2 /run/finalrd-libs.conf

finalrd New Fork (PID: 6436, Parent: 6233)

dirname (PID: 6436, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libdl.so.2

finalrd New Fork (PID: 6437, Parent: 6233)

realpath (PID: 6437, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libdl.so.2

finalrd New Fork (PID: 6438, Parent: 6233)

readlink (PID: 6438, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libdl.so.2

finalrd New Fork (PID: 6439, Parent: 6233)

grep (PID: 6439, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libpcre2-8.so.0 /run/finalrd-libs.conf

finalrd New Fork (PID: 6440, Parent: 6233)

dirname (PID: 6440, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libpcre2-8.so.0

finalrd New Fork (PID: 6441, Parent: 6233)

realpath (PID: 6441, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libpcre2-8.so.0

finalrd New Fork (PID: 6442, Parent: 6233)

readlink (PID: 6442, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libpcre2-8.so.0

finalrd New Fork (PID: 6443, Parent: 6233)

grep (PID: 6443, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libudev.so.1 /run/finalrd-libs.conf

finalrd New Fork (PID: 6444, Parent: 6233)

dirname (PID: 6444, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libudev.so.1

finalrd New Fork (PID: 6445, Parent: 6233)

realpath (PID: 6445, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libudev.so.1

finalrd New Fork (PID: 6446, Parent: 6233)

readlink (PID: 6446, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libudev.so.1

finalrd New Fork (PID: 6447, Parent: 6233)

grep (PID: 6447, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libm.so.6 /run/finalrd-libs.conf

finalrd New Fork (PID: 6448, Parent: 6233)

dirname (PID: 6448, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libm.so.6

finalrd New Fork (PID: 6449, Parent: 6233)

realpath (PID: 6449, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libm.so.6

finalrd New Fork (PID: 6450, Parent: 6233)

readlink (PID: 6450, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libm.so.6

finalrd New Fork (PID: 6451, Parent: 6233)

grep (PID: 6451, Parent: 6233, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -q /lib/x86_64-linux-gnu/libcap-ng.so.0 /run/finalrd-libs.conf

finalrd New Fork (PID: 6452, Parent: 6233)

dirname (PID: 6452, Parent: 6233, MD5: aafc5c13efcc5fc5b28b2cce6547765a) Arguments: dirname /run/initramfs/lib/x86_64-linux-gnu/libcap-ng.so.0

finalrd New Fork (PID: 6453, Parent: 6233)

realpath (PID: 6453, Parent: 6233, MD5: 70960c70b9582a7a4d6ddf8df1f5f0cb) Arguments: realpath -e /lib/x86_64-linux-gnu/libcap-ng.so.0

finalrd New Fork (PID: 6454, Parent: 6233)

readlink (PID: 6454, Parent: 6233, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink /lib/x86_64-linux-gnu/libcap-ng.so.0

finalrd New Fork (PID: 6455, Parent: 6233)

systemd-tmpfiles (PID: 6455, Parent: 6233, MD5: cbfd740d267e838093587622f76091a3) Arguments: systemd-tmpfiles --create /usr/lib/finalrd/finalrd-static.conf /run/finalrd-libs.conf

finalrd New Fork (PID: 6457, Parent: 6233)

run-parts (PID: 6457, Parent: 6233, MD5: 6874c76376776a1c42c8690e1c5c34a8) Arguments: run-parts -v --regex=^.*\\.finalrd$ --arg=setup -- /usr/share/finalrd

run-parts New Fork (PID: 6458, Parent: 6457)

mdadm.finalrd (PID: 6458, Parent: 6457, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/finalrd/mdadm.finalrd setup

mdadm.finalrd New Fork (PID: 6459, Parent: 6458)

mkdir (PID: 6459, Parent: 6458, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/sbin

mdadm.finalrd New Fork (PID: 6460, Parent: 6458)

cp (PID: 6460, Parent: 6458, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /sbin/mdadm /run/initramfs//usr/sbin/mdadm

mdadm.finalrd New Fork (PID: 6461, Parent: 6458)

mdadm.finalrd New Fork (PID: 6462, Parent: 6461)

env (PID: 6462, Parent: 6461, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /sbin/mdadm

ldd (PID: 6462, Parent: 6461, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /sbin/mdadm

ldd New Fork (PID: 6464, Parent: 6462)

ldd New Fork (PID: 6465, Parent: 6464)

ld-linux.so.2 (PID: 6465, Parent: 6464, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6466, Parent: 6462)

ld-linux.so.2 (PID: 6466, Parent: 6462, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /sbin/mdadm

ldd New Fork (PID: 6467, Parent: 6462)

ldd New Fork (PID: 6468, Parent: 6467)

ld-linux-x86-64.so.2 (PID: 6468, Parent: 6467, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6469, Parent: 6462)

ld-linux-x86-64.so.2 (PID: 6469, Parent: 6462, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /sbin/mdadm

ldd New Fork (PID: 6470, Parent: 6462)

ldd New Fork (PID: 6471, Parent: 6470)

ldd New Fork (PID: 6472, Parent: 6471)

ld-linux-x86-64.so.2 (PID: 6472, Parent: 6471, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /sbin/mdadm

mdadm.finalrd New Fork (PID: 6463, Parent: 6461)

sed (PID: 6463, Parent: 6461, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

mdadm.finalrd New Fork (PID: 6473, Parent: 6458)

mdadm.finalrd New Fork (PID: 6474, Parent: 6473)

mdadm.finalrd New Fork (PID: 6475, Parent: 6473)

sed (PID: 6475, Parent: 6473, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6476, Parent: 6458)

mdadm.finalrd New Fork (PID: 6477, Parent: 6476)

mdadm.finalrd New Fork (PID: 6478, Parent: 6476)

sed (PID: 6478, Parent: 6476, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6479, Parent: 6458)

mdadm.finalrd New Fork (PID: 6480, Parent: 6479)

mdadm.finalrd New Fork (PID: 6481, Parent: 6479)

sed (PID: 6481, Parent: 6479, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6482, Parent: 6458)

mdadm.finalrd New Fork (PID: 6483, Parent: 6482)

mdadm.finalrd New Fork (PID: 6484, Parent: 6482)

sed (PID: 6484, Parent: 6482, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6485, Parent: 6458)

mdadm.finalrd New Fork (PID: 6486, Parent: 6485)

mdadm.finalrd New Fork (PID: 6487, Parent: 6485)

sed (PID: 6487, Parent: 6485, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6488, Parent: 6458)

mdadm.finalrd New Fork (PID: 6489, Parent: 6488)

mdadm.finalrd New Fork (PID: 6490, Parent: 6488)

sed (PID: 6490, Parent: 6488, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6491, Parent: 6458)

mkdir (PID: 6491, Parent: 6458, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/sbin

mdadm.finalrd New Fork (PID: 6492, Parent: 6458)

cp (PID: 6492, Parent: 6458, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /sbin/mdmon /run/initramfs//usr/sbin/mdmon

mdadm.finalrd New Fork (PID: 6493, Parent: 6458)

mdadm.finalrd New Fork (PID: 6494, Parent: 6493)

env (PID: 6494, Parent: 6493, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /sbin/mdmon

ldd (PID: 6494, Parent: 6493, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /sbin/mdmon

ldd New Fork (PID: 6496, Parent: 6494)

ldd New Fork (PID: 6497, Parent: 6496)

ld-linux.so.2 (PID: 6497, Parent: 6496, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6498, Parent: 6494)

ld-linux.so.2 (PID: 6498, Parent: 6494, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /sbin/mdmon

ldd New Fork (PID: 6499, Parent: 6494)

ldd New Fork (PID: 6500, Parent: 6499)

ld-linux-x86-64.so.2 (PID: 6500, Parent: 6499, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6501, Parent: 6494)

ld-linux-x86-64.so.2 (PID: 6501, Parent: 6494, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /sbin/mdmon

ldd New Fork (PID: 6502, Parent: 6494)

ldd New Fork (PID: 6503, Parent: 6502)

ldd New Fork (PID: 6504, Parent: 6503)

ld-linux-x86-64.so.2 (PID: 6504, Parent: 6503, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /sbin/mdmon

mdadm.finalrd New Fork (PID: 6495, Parent: 6493)

sed (PID: 6495, Parent: 6493, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

mdadm.finalrd New Fork (PID: 6507, Parent: 6458)

mdadm.finalrd New Fork (PID: 6508, Parent: 6507)

mdadm.finalrd New Fork (PID: 6509, Parent: 6507)

sed (PID: 6509, Parent: 6507, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6510, Parent: 6458)

mdadm.finalrd New Fork (PID: 6511, Parent: 6510)

mdadm.finalrd New Fork (PID: 6512, Parent: 6510)

sed (PID: 6512, Parent: 6510, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6513, Parent: 6458)

mdadm.finalrd New Fork (PID: 6514, Parent: 6513)

mdadm.finalrd New Fork (PID: 6515, Parent: 6513)

sed (PID: 6515, Parent: 6513, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6516, Parent: 6458)

mdadm.finalrd New Fork (PID: 6517, Parent: 6516)

mdadm.finalrd New Fork (PID: 6518, Parent: 6516)

sed (PID: 6518, Parent: 6516, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6519, Parent: 6458)

mkdir (PID: 6519, Parent: 6458, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu

mdadm.finalrd New Fork (PID: 6520, Parent: 6458)

cp (PID: 6520, Parent: 6458, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /lib/x86_64-linux-gnu/libgcc_s.so.1 /run/initramfs//usr/lib/x86_64-linux-gnu/libgcc_s.so.1

mdadm.finalrd New Fork (PID: 6521, Parent: 6458)

mdadm.finalrd New Fork (PID: 6522, Parent: 6521)

env (PID: 6522, Parent: 6521, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /lib/x86_64-linux-gnu/libgcc_s.so.1

ldd (PID: 6522, Parent: 6521, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /lib/x86_64-linux-gnu/libgcc_s.so.1

ldd New Fork (PID: 6524, Parent: 6522)

ldd New Fork (PID: 6525, Parent: 6524)

ld-linux.so.2 (PID: 6525, Parent: 6524, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6526, Parent: 6522)

ld-linux.so.2 (PID: 6526, Parent: 6522, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /lib/x86_64-linux-gnu/libgcc_s.so.1

ldd New Fork (PID: 6527, Parent: 6522)

ldd New Fork (PID: 6528, Parent: 6527)

ld-linux-x86-64.so.2 (PID: 6528, Parent: 6527, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6529, Parent: 6522)

ld-linux-x86-64.so.2 (PID: 6529, Parent: 6522, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /lib/x86_64-linux-gnu/libgcc_s.so.1

ldd New Fork (PID: 6530, Parent: 6522)

ldd New Fork (PID: 6531, Parent: 6530)

ldd New Fork (PID: 6532, Parent: 6531)

ld-linux-x86-64.so.2 (PID: 6532, Parent: 6531, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /lib/x86_64-linux-gnu/libgcc_s.so.1

mdadm.finalrd New Fork (PID: 6523, Parent: 6521)

sed (PID: 6523, Parent: 6521, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

mdadm.finalrd New Fork (PID: 6533, Parent: 6458)

mdadm.finalrd New Fork (PID: 6534, Parent: 6533)

mdadm.finalrd New Fork (PID: 6535, Parent: 6533)

sed (PID: 6535, Parent: 6533, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6536, Parent: 6458)

mdadm.finalrd New Fork (PID: 6537, Parent: 6536)

mdadm.finalrd New Fork (PID: 6538, Parent: 6536)

sed (PID: 6538, Parent: 6536, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6539, Parent: 6458)

mdadm.finalrd New Fork (PID: 6540, Parent: 6539)

mdadm.finalrd New Fork (PID: 6541, Parent: 6539)

sed (PID: 6541, Parent: 6539, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6542, Parent: 6458)

mdadm.finalrd New Fork (PID: 6543, Parent: 6542)

mdadm.finalrd New Fork (PID: 6544, Parent: 6542)

sed (PID: 6544, Parent: 6542, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6545, Parent: 6458)

mdadm.finalrd New Fork (PID: 6546, Parent: 6545)

mdadm.finalrd New Fork (PID: 6547, Parent: 6545)

sed (PID: 6547, Parent: 6545, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6548, Parent: 6458)

mdadm.finalrd New Fork (PID: 6549, Parent: 6548)

mdadm.finalrd New Fork (PID: 6550, Parent: 6548)

sed (PID: 6550, Parent: 6548, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

mdadm.finalrd New Fork (PID: 6551, Parent: 6458)

mdadm.finalrd New Fork (PID: 6552, Parent: 6551)

mdadm.finalrd New Fork (PID: 6553, Parent: 6551)

sed (PID: 6553, Parent: 6551, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

mdadm.finalrd New Fork (PID: 6554, Parent: 6458)

mdadm.finalrd New Fork (PID: 6555, Parent: 6554)

mdadm.finalrd New Fork (PID: 6556, Parent: 6554)

sed (PID: 6556, Parent: 6554, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

run-parts New Fork (PID: 6557, Parent: 6457)

open-iscsi.finalrd (PID: 6557, Parent: 6457, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/finalrd/open-iscsi.finalrd setup

open-iscsi.finalrd New Fork (PID: 6558, Parent: 6557)

mkdir (PID: 6558, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/bin

open-iscsi.finalrd New Fork (PID: 6559, Parent: 6557)

cp (PID: 6559, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /bin/grep /run/initramfs//usr/bin/grep

open-iscsi.finalrd New Fork (PID: 6560, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6561, Parent: 6560)

env (PID: 6561, Parent: 6560, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /bin/grep

ldd (PID: 6561, Parent: 6560, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /bin/grep

ldd New Fork (PID: 6563, Parent: 6561)

ldd New Fork (PID: 6564, Parent: 6563)

ld-linux.so.2 (PID: 6564, Parent: 6563, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6565, Parent: 6561)

ld-linux.so.2 (PID: 6565, Parent: 6561, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /bin/grep

ldd New Fork (PID: 6566, Parent: 6561)

ldd New Fork (PID: 6567, Parent: 6566)

ld-linux-x86-64.so.2 (PID: 6567, Parent: 6566, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6568, Parent: 6561)

ld-linux-x86-64.so.2 (PID: 6568, Parent: 6561, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /bin/grep

ldd New Fork (PID: 6569, Parent: 6561)

ldd New Fork (PID: 6570, Parent: 6569)

ldd New Fork (PID: 6571, Parent: 6570)

ld-linux-x86-64.so.2 (PID: 6571, Parent: 6570, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /bin/grep

open-iscsi.finalrd New Fork (PID: 6562, Parent: 6560)

sed (PID: 6562, Parent: 6560, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

open-iscsi.finalrd New Fork (PID: 6572, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6573, Parent: 6572)

open-iscsi.finalrd New Fork (PID: 6574, Parent: 6572)

sed (PID: 6574, Parent: 6572, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6575, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6576, Parent: 6575)

open-iscsi.finalrd New Fork (PID: 6577, Parent: 6575)

sed (PID: 6577, Parent: 6575, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6578, Parent: 6557)

mkdir (PID: 6578, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu

open-iscsi.finalrd New Fork (PID: 6579, Parent: 6557)

readlink (PID: 6579, Parent: 6557, MD5: 1a35f72a795244327f5f8107152018c6) Arguments: readlink -f /lib/x86_64-linux-gnu/libpcre.so.3

open-iscsi.finalrd New Fork (PID: 6580, Parent: 6557)

ln (PID: 6580, Parent: 6557, MD5: e933cf05571f62c0157d4e2dfcaea282) Arguments: ln -rs /run/initramfs//usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 /run/initramfs//usr/lib/x86_64-linux-gnu/libpcre.so.3

open-iscsi.finalrd New Fork (PID: 6581, Parent: 6557)

mkdir (PID: 6581, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu

open-iscsi.finalrd New Fork (PID: 6582, Parent: 6557)

cp (PID: 6582, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3 /run/initramfs//usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3

open-iscsi.finalrd New Fork (PID: 6583, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6584, Parent: 6583)

open-iscsi.finalrd New Fork (PID: 6585, Parent: 6583)

sed (PID: 6585, Parent: 6583, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6586, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6587, Parent: 6586)

open-iscsi.finalrd New Fork (PID: 6588, Parent: 6586)

sed (PID: 6588, Parent: 6586, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6589, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6590, Parent: 6589)

open-iscsi.finalrd New Fork (PID: 6591, Parent: 6589)

sed (PID: 6591, Parent: 6589, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6592, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6593, Parent: 6592)

open-iscsi.finalrd New Fork (PID: 6594, Parent: 6592)

sed (PID: 6594, Parent: 6592, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6595, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6596, Parent: 6595)

open-iscsi.finalrd New Fork (PID: 6597, Parent: 6595)

sed (PID: 6597, Parent: 6595, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6598, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6599, Parent: 6598)

open-iscsi.finalrd New Fork (PID: 6600, Parent: 6598)

sed (PID: 6600, Parent: 6598, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6601, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6602, Parent: 6601)

open-iscsi.finalrd New Fork (PID: 6603, Parent: 6601)

sed (PID: 6603, Parent: 6601, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6604, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6605, Parent: 6604)

open-iscsi.finalrd New Fork (PID: 6606, Parent: 6604)

sed (PID: 6606, Parent: 6604, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6607, Parent: 6557)

mkdir (PID: 6607, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/bin

open-iscsi.finalrd New Fork (PID: 6608, Parent: 6557)

cp (PID: 6608, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /bin/sleep /run/initramfs//usr/bin/sleep

open-iscsi.finalrd New Fork (PID: 6609, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6610, Parent: 6609)

env (PID: 6610, Parent: 6609, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /bin/sleep

ldd (PID: 6610, Parent: 6609, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /bin/sleep

ldd New Fork (PID: 6612, Parent: 6610)

ldd New Fork (PID: 6613, Parent: 6612)

ld-linux.so.2 (PID: 6613, Parent: 6612, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6614, Parent: 6610)

ld-linux.so.2 (PID: 6614, Parent: 6610, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /bin/sleep

ldd New Fork (PID: 6615, Parent: 6610)

ldd New Fork (PID: 6616, Parent: 6615)

ld-linux-x86-64.so.2 (PID: 6616, Parent: 6615, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6617, Parent: 6610)

ld-linux-x86-64.so.2 (PID: 6617, Parent: 6610, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /bin/sleep

ldd New Fork (PID: 6618, Parent: 6610)

ldd New Fork (PID: 6619, Parent: 6618)

ldd New Fork (PID: 6620, Parent: 6619)

ld-linux-x86-64.so.2 (PID: 6620, Parent: 6619, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /bin/sleep

open-iscsi.finalrd New Fork (PID: 6611, Parent: 6609)

sed (PID: 6611, Parent: 6609, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

open-iscsi.finalrd New Fork (PID: 6621, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6622, Parent: 6621)

open-iscsi.finalrd New Fork (PID: 6623, Parent: 6621)

sed (PID: 6623, Parent: 6621, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6624, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6625, Parent: 6624)

open-iscsi.finalrd New Fork (PID: 6626, Parent: 6624)

sed (PID: 6626, Parent: 6624, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6627, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6628, Parent: 6627)

open-iscsi.finalrd New Fork (PID: 6629, Parent: 6627)

sed (PID: 6629, Parent: 6627, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6630, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6631, Parent: 6630)

open-iscsi.finalrd New Fork (PID: 6632, Parent: 6630)

sed (PID: 6632, Parent: 6630, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6633, Parent: 6557)

mkdir (PID: 6633, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/sbin

open-iscsi.finalrd New Fork (PID: 6635, Parent: 6557)

cp (PID: 6635, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /sbin/iscsiadm /run/initramfs//usr/sbin/iscsiadm

open-iscsi.finalrd New Fork (PID: 6636, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6637, Parent: 6636)

env (PID: 6637, Parent: 6636, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /sbin/iscsiadm

ldd (PID: 6637, Parent: 6636, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /sbin/iscsiadm

ldd New Fork (PID: 6639, Parent: 6637)

ldd New Fork (PID: 6640, Parent: 6639)

ld-linux.so.2 (PID: 6640, Parent: 6639, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6641, Parent: 6637)

ld-linux.so.2 (PID: 6641, Parent: 6637, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /sbin/iscsiadm

ldd New Fork (PID: 6642, Parent: 6637)

ldd New Fork (PID: 6643, Parent: 6642)

ld-linux-x86-64.so.2 (PID: 6643, Parent: 6642, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6644, Parent: 6637)

ld-linux-x86-64.so.2 (PID: 6644, Parent: 6637, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /sbin/iscsiadm

ldd New Fork (PID: 6645, Parent: 6637)

ldd New Fork (PID: 6646, Parent: 6645)

ldd New Fork (PID: 6647, Parent: 6646)

ld-linux-x86-64.so.2 (PID: 6647, Parent: 6646, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /sbin/iscsiadm

open-iscsi.finalrd New Fork (PID: 6638, Parent: 6636)

sed (PID: 6638, Parent: 6636, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

open-iscsi.finalrd New Fork (PID: 6648, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6649, Parent: 6648)

open-iscsi.finalrd New Fork (PID: 6650, Parent: 6648)

sed (PID: 6650, Parent: 6648, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6651, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6652, Parent: 6651)

open-iscsi.finalrd New Fork (PID: 6653, Parent: 6651)

sed (PID: 6653, Parent: 6651, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6654, Parent: 6557)

mkdir (PID: 6654, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu

open-iscsi.finalrd New Fork (PID: 6655, Parent: 6557)

cp (PID: 6655, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /lib/x86_64-linux-gnu/libisns-nocrypto.so.0 /run/initramfs//usr/lib/x86_64-linux-gnu/libisns-nocrypto.so.0

open-iscsi.finalrd New Fork (PID: 6656, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6657, Parent: 6656)

open-iscsi.finalrd New Fork (PID: 6658, Parent: 6656)

sed (PID: 6658, Parent: 6656, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6659, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6660, Parent: 6659)

open-iscsi.finalrd New Fork (PID: 6661, Parent: 6659)

sed (PID: 6661, Parent: 6659, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6662, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6663, Parent: 6662)

open-iscsi.finalrd New Fork (PID: 6664, Parent: 6662)

sed (PID: 6664, Parent: 6662, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6665, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6666, Parent: 6665)

open-iscsi.finalrd New Fork (PID: 6667, Parent: 6665)

sed (PID: 6667, Parent: 6665, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6668, Parent: 6557)

mkdir (PID: 6668, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/sbin

open-iscsi.finalrd New Fork (PID: 6669, Parent: 6557)

cp (PID: 6669, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /sbin/iscsid /run/initramfs//usr/sbin/iscsid

open-iscsi.finalrd New Fork (PID: 6670, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6671, Parent: 6670)

env (PID: 6671, Parent: 6670, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /sbin/iscsid

ldd (PID: 6671, Parent: 6670, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /sbin/iscsid

ldd New Fork (PID: 6673, Parent: 6671)

ldd New Fork (PID: 6674, Parent: 6673)

ld-linux.so.2 (PID: 6674, Parent: 6673, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6675, Parent: 6671)

ld-linux.so.2 (PID: 6675, Parent: 6671, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /sbin/iscsid

ldd New Fork (PID: 6676, Parent: 6671)

ldd New Fork (PID: 6677, Parent: 6676)

ld-linux-x86-64.so.2 (PID: 6677, Parent: 6676, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6678, Parent: 6671)

ld-linux-x86-64.so.2 (PID: 6678, Parent: 6671, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /sbin/iscsid

ldd New Fork (PID: 6679, Parent: 6671)

ldd New Fork (PID: 6680, Parent: 6679)

ldd New Fork (PID: 6681, Parent: 6680)

ld-linux-x86-64.so.2 (PID: 6681, Parent: 6680, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /sbin/iscsid

open-iscsi.finalrd New Fork (PID: 6672, Parent: 6670)

sed (PID: 6672, Parent: 6670, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

open-iscsi.finalrd New Fork (PID: 6682, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6683, Parent: 6682)

open-iscsi.finalrd New Fork (PID: 6684, Parent: 6682)

sed (PID: 6684, Parent: 6682, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6685, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6686, Parent: 6685)

open-iscsi.finalrd New Fork (PID: 6687, Parent: 6685)

sed (PID: 6687, Parent: 6685, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6688, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6689, Parent: 6688)

open-iscsi.finalrd New Fork (PID: 6690, Parent: 6688)

sed (PID: 6690, Parent: 6688, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6691, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6692, Parent: 6691)

open-iscsi.finalrd New Fork (PID: 6693, Parent: 6691)

sed (PID: 6693, Parent: 6691, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6694, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6695, Parent: 6694)

open-iscsi.finalrd New Fork (PID: 6696, Parent: 6694)

sed (PID: 6696, Parent: 6694, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6697, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6698, Parent: 6697)

open-iscsi.finalrd New Fork (PID: 6699, Parent: 6697)

sed (PID: 6699, Parent: 6697, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6700, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6701, Parent: 6700)

open-iscsi.finalrd New Fork (PID: 6702, Parent: 6700)

sed (PID: 6702, Parent: 6700, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6703, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6704, Parent: 6703)

open-iscsi.finalrd New Fork (PID: 6705, Parent: 6703)

sed (PID: 6705, Parent: 6703, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6706, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6707, Parent: 6706)

open-iscsi.finalrd New Fork (PID: 6708, Parent: 6706)

sed (PID: 6708, Parent: 6706, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6709, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6710, Parent: 6709)

open-iscsi.finalrd New Fork (PID: 6711, Parent: 6709)

sed (PID: 6711, Parent: 6709, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6712, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6713, Parent: 6712)

open-iscsi.finalrd New Fork (PID: 6714, Parent: 6712)

sed (PID: 6714, Parent: 6712, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6715, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6716, Parent: 6715)

open-iscsi.finalrd New Fork (PID: 6717, Parent: 6715)

sed (PID: 6717, Parent: 6715, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6718, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6719, Parent: 6718)

open-iscsi.finalrd New Fork (PID: 6720, Parent: 6718)

sed (PID: 6720, Parent: 6718, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6723, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6724, Parent: 6723)

open-iscsi.finalrd New Fork (PID: 6725, Parent: 6723)

sed (PID: 6725, Parent: 6723, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6726, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6727, Parent: 6726)

open-iscsi.finalrd New Fork (PID: 6728, Parent: 6726)

sed (PID: 6728, Parent: 6726, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6729, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6730, Parent: 6729)

open-iscsi.finalrd New Fork (PID: 6731, Parent: 6729)

sed (PID: 6731, Parent: 6729, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6732, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6733, Parent: 6732)

open-iscsi.finalrd New Fork (PID: 6734, Parent: 6732)

sed (PID: 6734, Parent: 6732, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6735, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6736, Parent: 6735)

open-iscsi.finalrd New Fork (PID: 6737, Parent: 6735)

sed (PID: 6737, Parent: 6735, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6738, Parent: 6557)

mkdir (PID: 6738, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//usr/bin

open-iscsi.finalrd New Fork (PID: 6739, Parent: 6557)

cp (PID: 6739, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /usr/bin/expr /run/initramfs//usr/bin/expr

open-iscsi.finalrd New Fork (PID: 6740, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6741, Parent: 6740)

env (PID: 6741, Parent: 6740, MD5: a07608ea9b03212885b826d00c37f0ab) Arguments: env --unset=LD_PRELOAD ldd /usr/bin/expr

ldd (PID: 6741, Parent: 6740, MD5: 7063c3930affe123baecd3b340f1ad2c) Arguments: ldd /usr/bin/expr

ldd New Fork (PID: 6743, Parent: 6741)

ldd New Fork (PID: 6744, Parent: 6743)

ld-linux.so.2 (PID: 6744, Parent: 6743, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2

ldd New Fork (PID: 6745, Parent: 6741)

ld-linux.so.2 (PID: 6745, Parent: 6741, MD5: 07dbe060343e577e8f87def7c339281a) Arguments: /lib/ld-linux.so.2 --verify /usr/bin/expr

ldd New Fork (PID: 6746, Parent: 6741)

ldd New Fork (PID: 6747, Parent: 6746)

ld-linux-x86-64.so.2 (PID: 6747, Parent: 6746, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2

ldd New Fork (PID: 6748, Parent: 6741)

ld-linux-x86-64.so.2 (PID: 6748, Parent: 6741, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 --verify /usr/bin/expr

ldd New Fork (PID: 6749, Parent: 6741)

ldd New Fork (PID: 6750, Parent: 6749)

ldd New Fork (PID: 6751, Parent: 6750)

ld-linux-x86-64.so.2 (PID: 6751, Parent: 6750, MD5: 1d4d7819b104d638947f331a88403d2b) Arguments: /lib64/ld-linux-x86-64.so.2 /usr/bin/expr

open-iscsi.finalrd New Fork (PID: 6742, Parent: 6740)

sed (PID: 6742, Parent: 6740, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.*=>[[:blank:]]*\$[^[:blank:]]*\$.*/\\1/};\n\t\ts/[[:blank:]]*\$[^[:blank:]]*\$ (.*)/\\1/"

open-iscsi.finalrd New Fork (PID: 6752, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6753, Parent: 6752)

open-iscsi.finalrd New Fork (PID: 6754, Parent: 6752)

sed (PID: 6754, Parent: 6752, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6755, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6756, Parent: 6755)

open-iscsi.finalrd New Fork (PID: 6757, Parent: 6755)

sed (PID: 6757, Parent: 6755, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6758, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6759, Parent: 6758)

open-iscsi.finalrd New Fork (PID: 6760, Parent: 6758)

sed (PID: 6760, Parent: 6758, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#/lib/\$[^/]*/\$\\?\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#/lib/\\1\\3#

open-iscsi.finalrd New Fork (PID: 6761, Parent: 6557)

open-iscsi.finalrd New Fork (PID: 6762, Parent: 6761)

open-iscsi.finalrd New Fork (PID: 6763, Parent: 6761)

sed (PID: 6763, Parent: 6761, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -e s#-linux-gnu/\$tls\\|i686\\|sse2\\|neon\\|vfp\$.*/\$lib.*\$#-linux-gnu/\\2#

open-iscsi.finalrd New Fork (PID: 6764, Parent: 6557)

mkdir (PID: 6764, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//etc/iscsi

open-iscsi.finalrd New Fork (PID: 6765, Parent: 6557)

cp (PID: 6765, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /etc/iscsi/iscsid.conf /run/initramfs//etc/iscsi/iscsid.conf

open-iscsi.finalrd New Fork (PID: 6766, Parent: 6557)

mkdir (PID: 6766, Parent: 6557, MD5: 088c9d1df5a28ed16c726eca15964cb7) Arguments: mkdir -p /run/initramfs//etc/iscsi

open-iscsi.finalrd New Fork (PID: 6767, Parent: 6557)

cp (PID: 6767, Parent: 6557, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -pP /etc/iscsi/initiatorname.iscsi /run/initramfs//etc/iscsi/initiatorname.iscsi

finalrd New Fork (PID: 6768, Parent: 6233)

find (PID: 6768, Parent: 6233, MD5: b68ef002f84cc54dd472238ba7df80ab) Arguments: find /usr/share/finalrd -executable -name *.finalrd -exec cp -- {} /run/initramfs/lib/systemd/system-shutdown ;

find New Fork (PID: 6769, Parent: 6768)

cp (PID: 6769, Parent: 6768, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -- /usr/share/finalrd/mdadm.finalrd /run/initramfs/lib/systemd/system-shutdown

find New Fork (PID: 6770, Parent: 6768)

cp (PID: 6770, Parent: 6768, MD5: 40f10ae7ea3e44218d1a8c306f79c83f) Arguments: cp -- /usr/share/finalrd/open-iscsi.finalrd /run/initramfs/lib/systemd/system-shutdown

finalrd New Fork (PID: 6771, Parent: 6233)

ldconfig (PID: 6771, Parent: 6233, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: ldconfig -r /run/initramfs

ldconfig.real (PID: 6771, Parent: 6233, MD5: cf725620cf31c0c148dfb25bfe210af6) Arguments: /sbin/ldconfig.real -r /run/initramfs

systemd New Fork (PID: 6234, Parent: 1)

lvm (PID: 6234, Parent: 1, MD5: 17e4982e23c8cfc7f6703702e947c665) Arguments: /sbin/lvm pvscan --cache 8:3

systemd New Fork (PID: 6238, Parent: 1)

systemd-random-seed (PID: 6238, Parent: 1, MD5: f679ed1b49b1b3a1c077e6772a8d79f4) Arguments: /lib/systemd/systemd-random-seed save

gdm3 New Fork (PID: 6270, Parent: 1320)

Default (PID: 6270, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6273, Parent: 1)

systemd-user-runtime-dir (PID: 6273, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 127

gvfsd-fuse New Fork (PID: 6275, Parent: 2038)

fusermount (PID: 6275, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6288, Parent: 1)

systemd-user-runtime-dir (PID: 6288, Parent: 1, MD5: d55f4b0847f88131dbcfb07435178e54) Arguments: /lib/systemd/systemd-user-runtime-dir stop 1000

systemd New Fork (PID: 6307, Parent: 1)

systemd-user-sessions (PID: 6307, Parent: 1, MD5: c848846174fc8e1724ab0ebaf1303d87) Arguments: /lib/systemd/systemd-user-sessions stop

systemd New Fork (PID: 6312, Parent: 1)

umount (PID: 6312, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /var/jbx/shared -c

systemd New Fork (PID: 6318, Parent: 1)

true (PID: 6318, Parent: 1, MD5: 589a58ff455dbd092cb3ba3dd2c4c63e) Arguments: /bin/true

systemd New Fork (PID: 6322, Parent: 1)

systemd-update-utmp (PID: 6322, Parent: 1, MD5: a61bb9def5fd39e2471f43edaa57bedf) Arguments: /lib/systemd/systemd-update-utmp shutdown

systemd New Fork (PID: 6772, Parent: 1)

umount (PID: 6772, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /boot -c

systemd New Fork (PID: 6773, Parent: 1)

umount (PID: 6773, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /run/snapd/ns/lxd.mnt -c

systemd New Fork (PID: 6774, Parent: 1)

umount (PID: 6774, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /snap/core18/1944 -c -l

systemd New Fork (PID: 6775, Parent: 1)

umount (PID: 6775, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /snap/core18/2128 -c -l

systemd New Fork (PID: 6780, Parent: 1)

umount (PID: 6780, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /snap/core20/1081 -c -l

systemd New Fork (PID: 6781, Parent: 1)

umount (PID: 6781, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /snap/lxd/21029 -c -l

systemd New Fork (PID: 6782, Parent: 1)

umount (PID: 6782, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /snap/lxd/21545 -c -l

systemd New Fork (PID: 6786, Parent: 1)

umount (PID: 6786, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /snap/snapd/12704 -c -l

systemd New Fork (PID: 6787, Parent: 1)

umount (PID: 6787, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /snap/snapd/12883 -c -l

systemd New Fork (PID: 6814, Parent: 1)

umount (PID: 6814, Parent: 1, MD5: 2a1758ef6cf863f285bc8a918edbc0be) Arguments: /bin/umount /run/snapd/ns -c

systemd-udevd New Fork (PID: 6820, Parent: 6788)

probe-bcache (PID: 6820, Parent: 6788, MD5: ea991fa4b8dd97915d8d013f1de9798a) Arguments: /lib/udev/probe-bcache -o udev /dev/loop1

systemd-udevd New Fork (PID: 6821, Parent: 6784)

probe-bcache (PID: 6821, Parent: 6784, MD5: ea991fa4b8dd97915d8d013f1de9798a) Arguments: /lib/udev/probe-bcache -o udev /dev/loop7

systemd-udevd New Fork (PID: 6822, Parent: 6779)

probe-bcache (PID: 6822, Parent: 6779, MD5: ea991fa4b8dd97915d8d013f1de9798a) Arguments: /lib/udev/probe-bcache -o udev /dev/loop3

systemd-udevd New Fork (PID: 6823, Parent: 6785)

probe-bcache (PID: 6823, Parent: 6785, MD5: ea991fa4b8dd97915d8d013f1de9798a) Arguments: /lib/udev/probe-bcache -o udev /dev/loop0

systemd-udevd New Fork (PID: 6824, Parent: 6789)

probe-bcache (PID: 6824, Parent: 6789, MD5: ea991fa4b8dd97915d8d013f1de9798a) Arguments: /lib/udev/probe-bcache -o udev /dev/loop4

systemd-udevd New Fork (PID: 6825, Parent: 6792)

probe-bcache (PID: 6825, Parent: 6792, MD5: ea991fa4b8dd97915d8d013f1de9798a) Arguments: /lib/udev/probe-bcache -o udev /dev/loop6

cleanup

Stderr: 2024/01/17 14:23:42 number of processor cores 22024/01/17 14:23:42 rsa token size 15152024/01/17 14:23:42 all file pools started..2024/01/17 14:23:42 scanning all files on /tmp2024/01/17 14:23:42 crypted: .xfsm-ICE-S33I802024/01/17 14:23:42 crypted: config-err-dHT8bZ2024/01/17 14:23:42 crypted: dmesgtail.log2024/01/17 14:23:42 all file pools stoped..2024/01/17 14:23:42 encryption sucess, done after time: 154.939877ms2024/01/17 14:23:48 clean memory .. done: exit code = 0

Source: /tmp/C.Linux.elf (PID: 6222)

Log file created: /var/jbx/shared/logs/dmesg.log

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/C.Linux.elf (PID: 6222)

File: /tmp/C.Linux.elf

Jump to behavior

Source: /bin/bash (PID: 6229)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/blkdeactivate (PID: 6232)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6462)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6494)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6522)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6561)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6610)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6637)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6671)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/ldd (PID: 6741)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/find (PID: 6768)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/ldconfig.real (PID: 6771)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/lvm (PID: 6234)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-update-utmp (PID: 6322)	Queries kernel information via 'uname':	Jump to behavior

Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: ./vmware-root_721-4290559889vmware-root_721-4290559889vmware-root_721-4290559889vmware-root_721-4290559889vmware-root_721-4290559889
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: hsperfdata_root/README_TO_DECRYPT.txt1515:falsehsperfdata_root/README_TO_DECRYPT.txt515:falsevmware-root_721-4290559889/README_TO_DECRYPT.txtU
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: vmware-root_721-4290559889?G
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: ./vmware-root_721-4290559889
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: vmware-root_721-4290559889/README_TO_DECRYPT.txt
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: vmware-root_721-4290559889
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: Dvmware-root_721-4290559889
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: vmware-root_721-4290559889/README_TO_DECRYPT.txtU
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp	Binary or memory string: vmware-root_721-4290559889/README_TO_DECRYPT.txt143082020a0282020100cefb76f0afea062e3a98236417f6a721423082020a0282020100cefb76f0afea062e3a98236417f6a7214273082020a0282020100cefb76f0afea062e3a98236417f6a721427f3082020a0282020100cefb76f0afea062e3a98236417f6a721427fe3082020a0282020100cefb76f0afea062e3a98236417f6a721427fe93082020a0282020100cefb76f0afea062e3a98236417f6a721427fe913082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9153082020a0282020100cefb76f0afea062e3a98236417f6a721427fe91573082020a0282020100cefb76f0afea062e3a98236417f6a721427fe915703082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9157083082020a0282020100cefb76f0afea062e3a98236417f6a721427fe91570833082020a0282020100cefb76f0afea062e3a98236417f6a721427fe915708333082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9157083343082020a0282020100cefb76f0afea062e3a98236417f6a723082020a0282020100cefb76f0afea062e3a98236417f6a7213082020a0282020100cefb76f0afea062e3a98236417f6a72143082020a0282020100cefb76f0afea062e3a98236417f6a721423082020a0282020100cefb76f0afea062e3a98236417f6a7214273082020a0282020100cefb76f0afea062e3a98236417f6a721427f3082020a0282020100cefb76f0afea062e3a98236417f6a721427fe3082020a0282020100cefb76f0afea062e3a98236417f6a721427fe93082020a0282020100cefb76f0afea062e3a98236417f6a721427fe913082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9153082020a0282020100cefb76f0afea062e3a98236417f6a721427fe91573082020a0282020100cefb76f0afea062e3a98236417f6a721427fe915703082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9157083082020a0282020100cefb76f0afea062e3a98236417f6a721427fe91570833082020a0282020100cefb76f0afea062e3a98236417f6a721427fe915708333082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9157083343082020a0282020100cefb76f0afea062e3a98236417f6a723082020a0282020100cefb76f0afea062e3a98236417f6a7213082020a0282020100cefb76f0afea062e3a98236417f6a72143082020a0282020100cefb76f0afea062e3a98236417f6a721423082020a0282020100cefb76f0afea062e3a98236417f6a7214273082020a0282020100cefb76f0afea062e3a98236417f6a721427f3082020a0282020100cefb76f0afea062e3a98236417f6a721427fe3082020a0282020100cefb76f0afea062e3a98236417f6a721427fe93082020a0282020100cefb76f0afea062e3a98236417f6a721427fe913082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9153082020a0282020100cefb76f0afea062e3a98236417f6a721427fe91573082020a0282020100cefb76f0afea062e3a98236417f6a721427fe915703082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9157083082020a0282020100cefb76f0afea062e3a98236417f6a721427fe91570833082020a0282020100cefb76f0afea062e3a98236417f6a721427fe915708333082020a0282020100cefb76f0afea062e3a98236417f6a721427fe9157083343082020a0282020100cefb76f0afea062e3a98236417f6a723082020a0282020100cefb76f0afea062e3a98236417f6a7213082020a0282020100cefb76f0afea062e3a98236417f6a72143082020a0282020100cefb76f0afea062e3a98236417f6a721423082020a0282020100cefb76f0afea062e3a98236417f6a7214273082020a0282020100cefb76f0afea062e3a98236417f6a721427f3082020a0282020100cefb76f0afea062e3a98236417f6a721427fe3082020a0282020100cefb76

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Command and Scripting Interpreter	Path Interception	Path Interception	1 File and Directory Permissions Modification	OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	1 Encrypted Channel	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Abuse Accessibility Features	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	1 Scripting	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Scripting	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Application Layer Protocol	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Steganography			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	Login Hook	11 File Deletion	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	Protocol Impersonation			Data Destruction	Virtual Private Server	Employee Names

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C.Linux.elf	58%	ReversingLabs	Linux.Ransomware.Kuiper
C.Linux.elf	57%	Virustotal		Browse
C.Linux.elf	100%	Avira	LINUX/Ransom.ciszh

Dropped Files

Source	Detection	Scanner	Link
/run/initramfs/usr/bin/expr	0%	ReversingLabs
/run/initramfs/usr/bin/expr	0%	Virustotal	Browse
/run/initramfs/usr/bin/grep	0%	ReversingLabs
/run/initramfs/usr/bin/grep	0%	Virustotal	Browse
/run/initramfs/usr/bin/sleep	0%	ReversingLabs
/run/initramfs/usr/bin/sleep	0%	Virustotal	Browse
/run/initramfs/usr/lib/systemd/system-shutdown/mdadm.finalrd	0%	ReversingLabs
/run/initramfs/usr/lib/systemd/system-shutdown/mdadm.finalrd	0%	Virustotal	Browse
/run/initramfs/usr/lib/systemd/system-shutdown/open-iscsi.finalrd	0%	ReversingLabs
/run/initramfs/usr/sbin/mdadm	0%	ReversingLabs
/run/initramfs/usr/sbin/mdadm	0%	Virustotal	Browse
/run/initramfs/usr/sbin/mdmon	0%	ReversingLabs
/run/initramfs/usr/sbin/mdmon	0%	Virustotal	Browse

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://qtox.github.io	0%	Avira URL Cloud	safe
https://tox.chat/download.html	0%	Avira URL Cloud	safe
https://translationproject.org/team/	0%	Avira URL Cloud	safe
https://qtox.github.io	0%	Virustotal		Browse
https://tox.chat/download.html	1%	Virustotal		Browse
https://translationproject.org/team/	0%	Virustotal		Browse

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.gnu.org/software/coreutils/	sleep.590.dr, expr.778.dr	false		high
https://ubuntu.com/engage/secure-kubernetes-at-the-edge	motd-news.18.dr	false		high
https://qtox.github.io	C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp, README_TO_DECRYPT.txt20.28.dr, README_TO_DECRYPT.txt12.28.dr, README_TO_DECRYPT.txt24.28.dr, README_TO_DECRYPT.txt19.28.dr, README_TO_DECRYPT.txt13.28.dr, README_TO_DECRYPT.txt.28.dr, README_TO_DECRYPT.txt25.28.dr, README_TO_DECRYPT.txt6.28.dr, README_TO_DECRYPT.txt5.28.dr, README_TO_DECRYPT.txt2.28.dr, README_TO_DECRYPT.txt15.28.dr, README_TO_DECRYPT.txt11.28.dr, README_TO_DECRYPT.txt4.28.dr, README_TO_DECRYPT.txt23.28.dr, README_TO_DECRYPT.txt18.28.dr, README_TO_DECRYPT.txt21.28.dr, README_TO_DECRYPT.txt9.28.dr, README_TO_DECRYPT.txt10.28.dr, README_TO_DECRYPT.txt0.28.dr, README_TO_DECRYPT.txt1.28.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://git.sv.gnu.org/cgit/grep.git/tree/AUTHORS	grep.516.dr	false		high
https://translationproject.org/team/	expr.778.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.gnu.org/gethelp/License	grep.516.dr	false		high
http://www.gnu.org/software/grep/General	grep.516.dr	false		high
https://gnu.org/licenses/gpl.html	sleep.590.dr, expr.778.dr, grep.516.dr	false		high
http://www.gnu.org/software/grep/	grep.516.dr	false		high
https://www.gnu.org/gethelp/	sleep.590.dr, expr.778.dr, grep.516.dr	false		high
https://gnu.org/licenses/gpl.htmlWritten	grep.516.dr	false		high
https://www.gnu.org/software/coreutils/Report	sleep.590.dr, expr.778.dr	false		high
https://tox.chat/download.html	C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp, README_TO_DECRYPT.txt20.28.dr, README_TO_DECRYPT.txt12.28.dr, README_TO_DECRYPT.txt24.28.dr, README_TO_DECRYPT.txt19.28.dr, README_TO_DECRYPT.txt13.28.dr, README_TO_DECRYPT.txt.28.dr, README_TO_DECRYPT.txt25.28.dr, README_TO_DECRYPT.txt6.28.dr, README_TO_DECRYPT.txt5.28.dr, README_TO_DECRYPT.txt2.28.dr, README_TO_DECRYPT.txt15.28.dr, README_TO_DECRYPT.txt11.28.dr, README_TO_DECRYPT.txt4.28.dr, README_TO_DECRYPT.txt23.28.dr, README_TO_DECRYPT.txt18.28.dr, README_TO_DECRYPT.txt21.28.dr, README_TO_DECRYPT.txt9.28.dr, README_TO_DECRYPT.txt10.28.dr, README_TO_DECRYPT.txt0.28.dr, README_TO_DECRYPT.txt1.28.dr	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
109.202.202.202	B.Linux.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.30240.491.elf	Get hash	malicious	Unknown	Browse
	fyD9BLllqM.elf	Get hash	malicious	Gafgyt	Browse
	9tgFmzmJSz.elf	Get hash	malicious	Gafgyt	Browse
	o47dZdWmrz.elf	Get hash	malicious	LockBit ransomware	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.14851.20497.elf	Get hash	malicious	Unknown	Browse
	EDNYtBrJFR.elf	Get hash	malicious	Gafgyt	Browse
	SecuriteInfo.com.Trojan.Linux.Gafgyt.25184.30672.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.23170.5075.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.17305.14194.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.9181.3795.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	http://89.190.156.10/w.sh	Get hash	malicious	Unknown	Browse
	pjbcPoY7fR.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	S4VH37oM4v.elf	Get hash	malicious	Gafgyt	Browse
	2GzW6kFpIa.elf	Get hash	malicious	Gafgyt	Browse
	lNuzw8rbDZ.elf	Get hash	malicious	Gafgyt	Browse
	jpfbvQCdR9.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	oDYUVDTRHg.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.43	B.Linux.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.30240.491.elf	Get hash	malicious	Unknown	Browse
	fyD9BLllqM.elf	Get hash	malicious	Gafgyt	Browse
	9tgFmzmJSz.elf	Get hash	malicious	Gafgyt	Browse
	o47dZdWmrz.elf	Get hash	malicious	LockBit ransomware	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.14851.20497.elf	Get hash	malicious	Unknown	Browse
	EDNYtBrJFR.elf	Get hash	malicious	Gafgyt	Browse
	SecuriteInfo.com.Trojan.Linux.Gafgyt.25184.30672.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.23170.5075.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.17305.14194.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.9181.3795.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	http://89.190.156.10/w.sh	Get hash	malicious	Unknown	Browse
	pjbcPoY7fR.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	S4VH37oM4v.elf	Get hash	malicious	Gafgyt	Browse
	2GzW6kFpIa.elf	Get hash	malicious	Gafgyt	Browse
	lNuzw8rbDZ.elf	Get hash	malicious	Gafgyt	Browse
	jpfbvQCdR9.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	oDYUVDTRHg.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.42	B.Linux.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.30240.491.elf	Get hash	malicious	Unknown	Browse
	fyD9BLllqM.elf	Get hash	malicious	Gafgyt	Browse
	9tgFmzmJSz.elf	Get hash	malicious	Gafgyt	Browse
	o47dZdWmrz.elf	Get hash	malicious	LockBit ransomware	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.14851.20497.elf	Get hash	malicious	Unknown	Browse
	EDNYtBrJFR.elf	Get hash	malicious	Gafgyt	Browse
	SecuriteInfo.com.Trojan.Linux.Gafgyt.25184.30672.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.23170.5075.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.17305.14194.elf	Get hash	malicious	Unknown	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.9181.3795.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	http://89.190.156.10/w.sh	Get hash	malicious	Unknown	Browse
	pjbcPoY7fR.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	S4VH37oM4v.elf	Get hash	malicious	Gafgyt	Browse
	2GzW6kFpIa.elf	Get hash	malicious	Gafgyt	Browse
	lNuzw8rbDZ.elf	Get hash	malicious	Gafgyt	Browse
	jpfbvQCdR9.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	oDYUVDTRHg.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	B.Linux.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.30240.491.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	fyD9BLllqM.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2lMVld5TXm.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	9tgFmzmJSz.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	o47dZdWmrz.elf	Get hash	malicious	LockBit ransomware	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.14851.20497.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	EDNYtBrJFR.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.Gafgyt.25184.30672.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.23170.5075.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.17305.14194.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.9181.3795.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	B8pqOzoL0x.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	http://89.190.156.10/w.sh	Get hash	malicious	Unknown	Browse	91.189.91.42
	pjbcPoY7fR.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	S4VH37oM4v.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2GzW6kFpIa.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	lNuzw8rbDZ.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
CANONICAL-ASGB	B.Linux.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.30240.491.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	fyD9BLllqM.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2lMVld5TXm.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	9tgFmzmJSz.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	o47dZdWmrz.elf	Get hash	malicious	LockBit ransomware	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.14851.20497.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	EDNYtBrJFR.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.Gafgyt.25184.30672.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.23170.5075.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.17305.14194.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.9181.3795.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	B8pqOzoL0x.elf	Get hash	malicious	Mirai, Moobot	Browse	185.125.190.26
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	http://89.190.156.10/w.sh	Get hash	malicious	Unknown	Browse	91.189.91.42
	pjbcPoY7fR.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	S4VH37oM4v.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	2GzW6kFpIa.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	lNuzw8rbDZ.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
INIT7CH	B.Linux.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.30240.491.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	fyD9BLllqM.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	9tgFmzmJSz.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	o47dZdWmrz.elf	Get hash	malicious	LockBit ransomware	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.14851.20497.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	EDNYtBrJFR.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.Gafgyt.25184.30672.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.23170.5075.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.17305.14194.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.9181.3795.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	http://89.190.156.10/w.sh	Get hash	malicious	Unknown	Browse	109.202.202.202
	pjbcPoY7fR.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	S4VH37oM4v.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	2GzW6kFpIa.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	lNuzw8rbDZ.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	file.exe	Get hash	malicious	BazaLoader	Browse	212.51.153.6
	jpfbvQCdR9.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/run/initramfs/usr/bin/grep	B.Linux.elf	Get hash	malicious	Unknown	Browse
/run/initramfs/usr/bin/expr	B.Linux.elf	Get hash	malicious	Unknown	Browse
/run/initramfs/usr/bin/sleep	B.Linux.elf	Get hash	malicious	Unknown	Browse
/run/initramfs/usr/lib/systemd/system-shutdown/mdadm.finalrd	B.Linux.elf	Get hash	malicious	Unknown	Browse

Created / dropped Files

/etc/ld.so.cache~

Download File

Process:	/sbin/ldconfig.real
File Type:	data
Category:	dropped
Size (bytes):	2690
Entropy (8bit):	4.505244649043918
Encrypted:	false
SSDEEP:	48:4xdfg1ati03DTFf16FBo17QXyQ01IJmSOW0WSGf44UgISzkB7aJBZ4/FJZ:4xthiSIgiOn
MD5:	25CF17507CB6E4E57946C038A91CE95D
SHA1:	DCEFD495E11F2F2B7F1BD368A02E989A9C21FC73
SHA-256:	6662B0A60817709318CF6CB71B04E0068A42C9CD376357F01E40C956FE34E9CD
SHA-512:	F139645B3C13B142129FBED3F93C815419F828C8F714B2B43758882DCFE208E44E07AEE1702353289AB69A7842FA5C64512C4837E2D255835C48600176AA955A
Malicious:	false
Reputation:	low
Preview:	glibc-ld.so.cache1.1#...............................x..........................................................................."...................H...X...................~...........................................................................#...................F...R...................t...................................................................................................;...................^...m...........................................................................................6...H...................p...............................................................................................H...\...............................................................................................-...................R...\...................\|........................................................................... ...................B...W...............libuuid.so.1./lib/x86_64-linux-gnu/libuuid.so.1.libunistring.so.2./lib/x86_64-linux-gnu/libunistring.so.2.libude

/run/.#nologinTrHln5

Download File

Process:	/lib/systemd/systemd-user-sessions
File Type:	ASCII text
Category:	dropped
Size (bytes):	121
Entropy (8bit):	4.33122584686512
Encrypted:	false
SSDEEP:	3:j4XZFBFLItMm3OKjsBADCs0UoMF/kJCJOFWfVEWYNm:m7BxI2qljEokkJqW9EWYNm
MD5:	6C00832888E3A14A0777C6242C4FCA65
SHA1:	3151A7C5D09C17CEE24DC9CE7FCC156A790A794A
SHA-256:	52B5364E18CF4C1BE6603E4A7D48F9CDA3E2246EF88F16E28C2490D4997559CE
SHA-512:	750E738456EC9D43088C8DC8945F80F90766635498FB1F0403AE5CF327A1ACC00BB111CC662A198E90CD330C91D32F920330820B86DF0DA35EE65CB3AD5DAEB2
Malicious:	false
Reputation:	low
Preview:	System is going down. Unprivileged users are not permitted to log in anymore. For technical details, see pam_nologin(8)..

/run/finalrd-libs.conf

Download File

Process:	/usr/bin/finalrd
File Type:	ASCII text
Category:	dropped
Size (bytes):	7460
Entropy (8bit):	4.673338746671904
Encrypted:	false
SSDEEP:	48:iydbfsWYbfAGgadUWYIwVmydbfsWYbfAGgk7Vydb/bDG2adUWYIwVmydbibKGLok:xsNQfTsNof86JMtcmarO8WyH0vyVl+H
MD5:	EBF6C5A397D12D8DD61DA8D30AADE916
SHA1:	44088EA9474FFA0D20911210C7129DF66910630F
SHA-256:	79AE51E3D413ED91369CE3D547708F26D8AF63EDD3D6781D682236CAF4091268
SHA-512:	E51163CEDB081AF72EE94ECCAE62346C709247273F07B5C26DB771B9DF7F2F1B24BDE134CBF523C50DB68CB1BC6BFC8E44D4C51351D5F3F3EF57A6D0DA89D2EA
Malicious:	false
Reputation:	low
Preview:	d /run/initramfs/lib/x86_64-linux-gnu.C /run/initramfs/usr/lib/x86_64-linux-gnu/libc-2.31.so - - - - /usr/lib/x86_64-linux-gnu/libc-2.31.so.L /run/initramfs/lib/x86_64-linux-gnu/libc.so.6 - - - - libc-2.31.so.d /run/initramfs/lib64.C /run/initramfs/usr/lib/x86_64-linux-gnu/ld-2.31.so - - - - /usr/lib/x86_64-linux-gnu/ld-2.31.so.L /run/initramfs/lib64/ld-linux-x86-64.so.2 - - - - /lib/x86_64-linux-gnu/ld-2.31.so.d /run/initramfs/lib/x86_64-linux-gnu.C /run/initramfs/usr/lib/x86_64-linux-gnu/libc-2.31.so - - - - /usr/lib/x86_64-linux-gnu/libc-2.31.so.L /run/initramfs/lib/x86_64-linux-gnu/libc.so.6 - - - - libc-2.31.so.d /run/initramfs/lib/systemd.C /run/initramfs/lib/systemd/libsystemd-shared-245.so - - - - /lib/systemd/libsystemd-shared-245.so.d /run/initramfs/lib/x86_64-linux-gnu.C /run/initramfs/usr/lib/x86_64-linux-gnu/libmount.so.1.1.0 - - - - /usr/lib/x86_64-linux-gnu/libmount.so.1.1.0.L /run/initramfs/lib/x86_64-linux-gnu/libmount.so.1 - - - - libmount.so.1.1.0.d /run/initramfs/li

/run/initramfs/etc/initrd-release

Download File

Process:	/usr/bin/systemd-tmpfiles
File Type:	ASCII text
Category:	dropped
Size (bytes):	138
Entropy (8bit):	5.027150251159426
Encrypted:	false
SSDEEP:	3:ddDMLEhsqrYHTPaG838BCMLEDjncjBrolBpDzg7qrBkM7qrd2ggDE8o:7QcsQqTibQlBbQF7Qd2DEj
MD5:	8E23E747DF496CE0ACE37BDD5303D653
SHA1:	92B00F1F7785896B901C5AA5127C8EC3206299F0
SHA-256:	0443F4E67518CE3A2221F1E56E28238CD6CFB7D90DA26B6F1EBB2DDD9B15956F
SHA-512:	7AAD57CFE3104D5361E86EE08F56DAF3A696DC0757538DDE924398DF6A1707555B72DA88927906312DFA06C5E7D32A2CEA48A93552B3C48CD4C0B6FDA3C38A8F
Malicious:	false
Reputation:	low
Preview:	NAME="FinalRD".VERSION="6".ID=finalrd.PRETTY_NAME="Final Runtime Directory Six - Half a dozen".VERSION_ID="6".VERSION_CODENAME=halfadozen.

/run/initramfs/etc/iscsi/initiatorname.iscsi

Download File

Process:	/usr/bin/cp
File Type:	ASCII text
Category:	dropped
Size (bytes):	349
Entropy (8bit):	4.915717877386535
Encrypted:	false
SSDEEP:	6:jCN9bZGvQuIMJAAFHQ0UWMSLA5RvG+uXRm5uAp0KRMSmX3muMOFmeDZpSzttYLTa:j4iouxv22M3vG+uXc5uAp5MT3a7e7TBo
MD5:	8256B1C4AA0D3A3458BFD261D0386B00
SHA1:	644FF0E4B8DE0BDBE2AEB14F138417B42BF9DF9F
SHA-256:	859978CFE51930690C71E9B5F88E31AF2081F9366E347D02BC0C0D9F513E6337
SHA-512:	360E3E93C905CD2F5BD37C8682921574286DBECBDCCA2163F6CD1EFFDCC3B05B3249A9F4C677E71D36C5F26DCD1F209711E3DF85D24B04F2557D308B297FA78D
Malicious:	false
Reputation:	low
Preview:	## DO NOT EDIT OR REMOVE THIS FILE!.## If you remove this file, the iSCSI daemon will not start..## If you change the InitiatorName, existing access control lists.## may reject this initiator. The InitiatorName must be unique.## for each iSCSI initiator. Do NOT duplicate iSCSI InitiatorNames..InitiatorName=iqn.1993-08.org.debian:01:4efdaa48c143.

/run/initramfs/etc/iscsi/iscsid.conf

Download File

Process:	/usr/bin/cp
File Type:	ASCII text
Category:	dropped
Size (bytes):	12440
Entropy (8bit):	4.771565665865651
Encrypted:	false
SSDEEP:	192:d2e82uTKbHzuTmRyel6fGrfQIDsxJ5cP2qikrmKoH6TYQBbPXambPXaRmemuTC1:GKbTTRyjfGzQh5cP2qikKKmG9vuTC1
MD5:	FC72BDD1C530AD5B8FD5760D260C7D91
SHA1:	8F7D9AD5D7E340D1AE5D8FC60AE4EFEE868ABD16
SHA-256:	1A26750D3DA66A052FBA76C85614791EB7BA7E5DBEEA391C2E6A05F5C66ED032
SHA-512:	218B7CFA5D95997CB4CC17BDA09A8BBECCA0280DE9ECE56C1B16B3B39F843FCAFA2A1FB58A572BB249E36B85646B2B992AC1338F62654BBEC35191A3269DC456
Malicious:	false
Preview:	#.# Open-iSCSI default configuration..# Could be located at /etc/iscsi/iscsid.conf or ~/.iscsid.conf.#.# Note: To set any of these values for a specific node/session run.# the iscsiadm --mode node --op command for the value. See the README.# and man page for iscsiadm for details on the --op command..#..######################.# iscsid daemon config.######################.# If you want iscsid to start the first time an iscsi tool.# needs to access it, instead of starting it when the init.# scripts run, set the iscsid startup command here. This.# should normally only need to be done by distro package.# maintainers..#.# Default for Fedora and RHEL. (uncomment to activate)..# iscsid.startup = /etc/rc.d/init.d/iscsid force-start.iscsid.startup = /bin/systemctl start iscsid.socket.#.# Default for upstream open-iscsi scripts (uncomment to activate)..# iscsid.startup = /sbin/iscsid..# Check for active mounts on devices reachable through a session.# and refuse to logout if there are any. Defaul

/run/initramfs/usr/bin/expr

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=757023d9aac16cd543d1c6f774b71243ebf00765, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	55640
Entropy (8bit):	5.195505313970634
Encrypted:	false
SSDEEP:	768:KfCg4QoAYwIg4QoAYw7zrjbTLD7zrjbTLD7zrjbTLD7zrjbTLDuGe2Om4v4CY/LU:TAQQ5k8v0YSHLvO7rjm
MD5:	BD39F52259334813CEDC609F830097B0
SHA1:	D77822C87D529AB92F0BB2CD5BA6BEECCA2E294A
SHA-256:	2816F3BC07E9238C6612F4F384A03E1D370939E628723827EF1D0BE173D5A7D0
SHA-512:	7FCE3D13C150866653F21900D9AC9F5ACF5FE650BDD47556BA6565F8482D87D1219704AE0A42B468544BC11CCF65784DC3DC29A2A0F48E56C25C60DAD85E1E1C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: B.Linux.elf, Detection: malicious, Browse
Preview:	.ELF..............>.....P)......@...................@.8...@.............@.......@.......@........................................................................................................................................................ ....... ....... ......Qe......Qe..............................................P/......P/......................P.......P.......P.......0.......................................................................................8.......8.......8....... ....... .......................X.......X.......X.......D.......D...............S.td....8.......8.......8....... ....... ...............P.td....................................................Q.td....................................................R.td....P.......P.......P.............................../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU.up#..l.C...t..C...e............GNU.........................;............!.$.#.VbI......;.......<...>...@...D.......E...F.......

/run/initramfs/usr/bin/grep

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=f4564437ed282494b69a191fcb07a56235cce8ff, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	199136
Entropy (8bit):	6.036918944832085
Encrypted:	false
SSDEEP:	6144:X4CaUo6Zsd44d0DVjBRywi0M0T90/00W00000U0G0T0000/HlZ6jbwhs:XUXhWDk30M0T90/00W00000U0G0T000b
MD5:	1E6EBB9DD094F774478F72727BDBA0F5
SHA1:	218B7372669EFA4A5A1634822C097F8072166C9B
SHA-256:	39214499F884820B46F0BA06822E347798B264362EDF607BF7668083B92CB51E
SHA-512:	087A54AA36183CCD2A5E16F2B4C838C627432453373ABF5335E13076F5FC9FC6572713094992CDB36158244BE341F2D90F93A33687DA0F1B7DB508415B1456F1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: B.Linux.elf, Detection: malicious, Browse
Preview:	.ELF..............>......d......@.......`...........@.8...@.............@.......@.......@........................................................................................................................0.......0.......................@.......@.......@.......................................`.......`.......`......p.......p.......................................................8;......................X.......X.......X.......................................8.......8.......8....... ....... .......................X.......X.......X.......D.......D...............S.td....8.......8.......8....... ....... ...............P.td............................\.......\...............Q.td....................................................R.td..................................................../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU..VD7.($........b5...............GNU.........................y................... .......y.................`(...~j.u.>.[.e.m.Pv.

/run/initramfs/usr/bin/sleep

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=6a293efb7a36aa18d243e744d675661eb833f692, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	39256
Entropy (8bit):	4.841039715789187
Encrypted:	false
SSDEEP:	768:inoA/91tldVNF91tldVNF91tIg4QoAYwIg4QoAYwIg4QoAIVoERrbB4SADZiilSA:FoEBbB41DYiwP7Nm
MD5:	FCBA58DB24E5E3672C4D70A3BB01D7A4
SHA1:	CAE542290D1BB5C91C637350E0A633F71FD2A6E4
SHA-256:	45CF3208DC6704E806BBC5D776E884B5487744BD75171A93930C94E9B9B20EBB
SHA-512:	3630389323FF0F12D9CE7F319CE23BCEF582AE9155D7AFB2B7B8C0BDA61A339E11A05CCD72DBD9ED2AD892ADBCA6DAC52B7701CF911AFEA1D352AA6099546F25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: B.Linux.elf, Detection: malicious, Browse
Preview:	.ELF..............>.....P(......@..................@.8...@.............@.......@.......@........................................................................................................................................................ ....... ....... ......!<......!<.......................`.......`.......`......8.......8...............................................................................x.......x.......x.......................................8.......8.......8....... ....... .......................X.......X.......X.......D.......D...............S.td....8.......8.......8....... ....... ...............P.td....lo......lo......lo..............................Q.td....................................................R.td............................P.......P.............../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU.j)>.z6...C.D.uf..3..............GNU........................./..............$.).VbI....../.......0...1...3...8.......9...:.......

/run/initramfs/usr/lib/systemd/system-shutdown/mdadm.finalrd

Download File

Process:	/usr/bin/cp
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	278
Entropy (8bit):	4.778507459605203
Encrypted:	false
SSDEEP:	6:hxgLRatMdg/A/a9QYhHjFHj7QOGHA9ECHcP:jO+MdOAkNjFHjUOIAt8
MD5:	41797798F5EB4FB8A4F815053467B168
SHA1:	988D9C3716BDF5914DEAA3000ECA0965907A9DB0
SHA-256:	889789FBFA0FAE89AFB44A2C85BF51B9B0E1C642A68CBB8F41138CABC26F4281
SHA-512:	F54EC3A99AAA00FBD6EDC7600D662492F577463A629A9C173BA7E475B55782082192BE3454DCC4F169C24E7C2C18882B85269529327E92E128A548984EBC8C50
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Joe Sandbox View:	Filename: B.Linux.elf, Detection: malicious, Browse
Preview:	#!/bin/sh.# SPDX-License-Identifier: GPL-3.0-only.set -e..if [ "$1" = "setup" ].then. . /usr/share/initramfs-tools/hook-functions. copy_exec /sbin/mdadm. copy_exec /sbin/mdmon.. exit 0.fi..mdmon --all --takeover.mdadm -vv --wait-clean --scan.mdadm -vv --stop --scan.

/run/initramfs/usr/lib/systemd/system-shutdown/open-iscsi.finalrd

Download File

Process:	/usr/bin/cp
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	1014
Entropy (8bit):	4.871908728111443
Encrypted:	false
SSDEEP:	24:jOKk5sIEnxpAE3Vw3FTGlGxIvjH2CNE39AMIB:qfEnx7VEFixjnEOJB
MD5:	77DFA0C172AC87CBA637D672958CBFEE
SHA1:	28894B4B27E455B49395CCFD3B48B8901B548135
SHA-256:	6E76F751B83E253DA3519478E68F95364C0D9580BA2CA54504AB86665B3E188F
SHA-512:	B465084D93ACCE56A8136D5C982BB5D132A81605A577B7AD20C28606B93073C46FEAD3F9F4B0AD55F0081BC079998C56AA4F24D43341F5209C519AABAEEFB5E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	#!/bin/sh.# SPDX-License-Identifier: GPL-3.0-only..set -e..if [ "$1" = "setup" ].then. . /usr/share/initramfs-tools/hook-functions. copy_exec /bin/grep. copy_exec /bin/sleep. copy_exec /sbin/iscsiadm. copy_exec /sbin/iscsid. # hm, not sure why expr is copied. copy_exec /usr/bin/expr. copy_file config /etc/iscsi/iscsid.conf. copy_file config /etc/iscsi/initiatorname.iscsi. exit 0.fi..# re-establish connection and logout during shutdown.# if initramfs did bring up open-iscsi on boot.[ -f /open-iscsi.interface ] \|\| exit 0..iscsid..# After restarting iscsid, wait for an active connection..# Limit the wait time in case of unexpected failure of iscsid..MAX_RETRIES=30.RETRY=0.while ! iscsiadm -m session -P 1 \| grep -q "iSCSI Connection State: LOGGED IN"; do. RETRY=$(($RETRY + 1)). if [ $RETRY -gt $MAX_RETRIES ]; then. echo "Unexpected iSCSI Connection State, forcing iSCSI logout.". break. fi. sleep 1.done..# Issue an iSCSI logout..iscsia

/run/initramfs/usr/lib/x86_64-linux-gnu/libgcc_s.so.1

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=4abd133cc80e01bb388a9c42d9e3cb338836544a, stripped
Category:	dropped
Size (bytes):	104984
Entropy (8bit):	5.780151474481698
Encrypted:	false
SSDEEP:	3072:MuLPOeQ1EBUe2lu5Xg2zky1vSZ3craDjY0J5psgwlcX:7L2eue2luzw8855p16c
MD5:	817A0A1F580F584A6EE4A2AA7ED2FE3E
SHA1:	EF7847B9D31A76A7BAA90ED08E3B104C85A1C894
SHA-256:	63EB91B5D726E401C5AFFB2A035E175C374CAE75CDF25A1F9B007C3E79328100
SHA-512:	C3F3037EF59DD7A4EA313BBA26FE1DA34D85107FC29B51BD0D283B2941B31DC3DB6DA8A84CC7AB1996D593108E2E8FEBE5E563CAEBCAD8FB93B0DF662C2B67AE
Malicious:	false
Preview:	.ELF..............>......5......@..................@.8...@.....................................()......().......................0.......0.......0......U.......U........................P.......P.......P......l3......l3........................................................................................................................................................... ....... ...............................................$.......$...............S.td............................ ....... ...............P.td.....\.......\.......\..............................Q.td....................................................R.td.........................8.......8...........................GNU.............................GNU.J..<....8..B...3.6TJ.........................$.....T..............@.D...... ....t....(..H.. ...(.5.`l..!.p`@..`.@.......$.....I..$..( .C...H....D....O....a...........................................!...$...&.......'...)...*...-.../...2...3...6.......7...8...<...=...?...

/run/initramfs/usr/lib/x86_64-linux-gnu/libisns-nocrypto.so.0

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, missing section headers at 471664
Category:	dropped
Size (bytes):	230064
Entropy (8bit):	5.437078969802312
Encrypted:	false
SSDEEP:	3072:hgCj1frv7RLxAOK9IdK+hJ4P422oc8sKkPUzxrtX7IBzVod3M:hbBfz1xQ9Ios4g2DnzxrtX7IBzVE8
MD5:	0D4BA7B40DF0951CC324D86E70B2CF97
SHA1:	838998119D66EFDBBBAFA5867B80CC4D4E80D233
SHA-256:	84CFBA77EB2DD59F955BBA02B981AD3209B2E6301011965F4A57BF1E398D6EF0
SHA-512:	044AC3E05A4E79A8D35D378469E1784335FB96AA83B313EB654EC078A6C24DE738F8BC9462FA0A1392DA0C2D74822DAA1CE87EA77DACE8F3E8939F0824DE61BB
Malicious:	false
Preview:	.ELF..............>.....P.......@........+..........@.8...@............................................................................................................................@.......@.......@.............................................................&......p,..............................................................................8.......8.......8.......$.......$...............P.td....d.......d.......d...............................Q.td....................................................R.td............................P.......P...........................GNU...&h.. @..I...#..r........i...@........ .K........0................."K..........@d@bhH..&A$B...$............V@.X..A .@........PE..."..... )..............D..Q...P.@. `..@.....$.3.Y...`....@....... ......A$..........0...Y... ...P.........D..,....@...... .@......`.....a...@.*............ .)............ ......R ...5@....@.....@...D.... ... .@...1.....".H........0.....@p.. .c..................D...........@ ......%.

/run/initramfs/usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ac83711fbcb2725ad376ca8f8c947f6a782e7a65, stripped
Category:	dropped
Size (bytes):	465008
Entropy (8bit):	6.275202751426953
Encrypted:	false
SSDEEP:	6144:BQZHXrZzWGqrhmfikSa3ZWVOhF6/adr+i:BGHXrQy5SOZqOaadCi
MD5:	A9D8E3E5934915C8FA5EF087402BA273
SHA1:	4664F281880B937776F8C23FF859F04AB1747579
SHA-256:	CF811D27B21603D7ECC953A057AFD6D69875FEFF6AF655E4720BBE0B420DD9AE
SHA-512:	F25D04283402F0E471F1461CD43E67684E671C021677DEAE336B5433B1AA020D49082CA1A5162750C123CC49766B321FC977B9037D672EB50E73DA731BDCFB8D
Malicious:	false
Preview:	.ELF..............>......"......@.......p...........@.8...@...................................................................... ....... ....... ......}.......}........................0.......0.......0..............................................................`.......8....................................................................................................... ....... ...............................................$.......$...............S.td............................ ....... ...............P.td....................................................Q.td....................................................R.td............................0.......0...........................GNU.............................GNU...q...rZ.v....jx.ze....................B....!...@.......X@."E.....":......................"...&...+...,...-...1.......2.......5...8...9.................E2g..... bG.s.........np\..o..f..'..q3n..1DX[.{..N....5....f...v..'.t........p.vTi..2<..(.7.!....).H..2Vs-S>.

/run/initramfs/usr/sbin/iscsiadm

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, missing section headers at 403496
Category:	dropped
Size (bytes):	391272
Entropy (8bit):	6.019007180510942
Encrypted:	false
SSDEEP:	6144:76nAcDqoQQGeYpN9DTj3P2gI54uDhMYRw21HDk:uAaQfN9z+l54uFO2
MD5:	5A14EA812B6DC5AD28A4DFCAA291AF05
SHA1:	4293405690D722E41595035AC89B78CA649D8278
SHA-256:	5D366A96890FCE19288BAD5C87E22253F21211F510AAE51DDD9BC234220A8ED3
SHA-512:	BA57B6DBF1A5211CE0E66E82463B9505ACC85D8AEEF5FFFA0104E2485E9CC1A04886D819C15C36DD1824748CF9138651931A20EC014415DEA68E327ADF0252F8
Malicious:	false
Preview:	.ELF..............>.....0.......@........ ..........@.8...@.............@.......@.......@........................................................................................................................A.......A.......................P.......P.......P.......................................0.......0.......0......0s......0s...............................................n....................................................................................8.......8.......8....... ....... .......................X.......X.......X.......D.......D...............S.td....8.......8.......8....... ....... ...............P.td............................\.......\...............Q.td....................................................R.td............................P.......P.............../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU..x6.}q......b"DB.;.V............GNU.........................................................(........e.m6t..9..2...............

/run/initramfs/usr/sbin/iscsid

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, missing section headers at 420088
Category:	dropped
Size (bytes):	407864
Entropy (8bit):	6.001771850895179
Encrypted:	false
SSDEEP:	6144:OO1qyPuP4bY8+U3wkwh7Nj+2I4mRgwy9a7/2t44s:OO9uPRU3wkwh7kL4m1Lks
MD5:	3A230220B701DCEC7276EF5EC77F73D4
SHA1:	B2723A52F9F994A0CB0E50B888BA29C16DEA1E13
SHA-256:	8C4CA26C39336D1A850D6BF8499F9055DECB5B3371BF095D475F52B984297342
SHA-512:	5F8C487B4AD95D23BFEB0A72FDC393753C08D609CCE3F540A728818CBE5A3BC2F32D0F67B92B45F41374672AFE6AEFB1309DB3D0FE3C95E816CB1ED8312A4D55
Malicious:	false
Preview:	.ELF..............>.............@........a..........@.8...@.............@.......@.......@........................................................................................................................S.......S.......................`.......`.......`.......................................`.......`.......`...............................................................o......X...............................................................................8.......8.......8....... ....... .......................X.......X.......X.......D.......D...............S.td....8.......8.......8....... ....... ...............P.td.... R...... R...... R..............................Q.td....................................................R.td............................0.......0.............../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU.K.+.....n%e[~vk....V............GNU.........................................................(....e.m6t..9.......1j.............

/run/initramfs/usr/sbin/mdadm

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=bcffe3c6cf318e21e53c24fab067cc8441bbe40f, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	603800
Entropy (8bit):	6.3274204729587
Encrypted:	false
SSDEEP:	12288:xw6ohuJnwgI6Tgslpjx0zaghTn3SqwBJb:xw62uJnVIJijaza1qwz
MD5:	72200E0373FBDEACAFE3094312DBF3E8
SHA1:	3EBC1C260D0BEE3FCBC0807E5FC40477973B7002
SHA-256:	63A2B028D2218D900D336EDD6A040A5B68C0C53F7385B6CBE1B0FD04F45FFE90
SHA-512:	5FB23DCB7BB481ED635314B515D7F085A5EADD850E300A28D5194F8185DD6B9FF49160DD9C569B304BADC1721FC254212DDEC25451901B548A4B22191824DAD2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	.ELF..............>.....p.......@......../..........@.8...@.............@.......@.......@........................................................................................................................T.......T.......................`.......`.......`......u_......u_..............................................................................0.......0.......0........u......x..............................................................................8.......8.......8....... ....... .......................X.......X.......X.......D.......D...............S.td....8.......8.......8....... ....... ...............P.td....................................................Q.td....................................................R.td....0.......0.......0.............................../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU......1.!.<$..g.A...............GNU.........................................................(....e.mfUa.9......................

/run/initramfs/usr/sbin/mdmon

Download File

Process:	/usr/bin/cp
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=abd7e550ad273af9dd0909941d23922a58f30427, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	333304
Entropy (8bit):	6.188758703255772
Encrypted:	false
SSDEEP:	6144:qe10Lg/2CiZOCaiJcHwIeBBWWlLboLEvz5HqxJzYAuBnxto:qeWLzCicccQIenWWlh5NH
MD5:	F16238310DF6BA7802121AB1DBAB1FC8
SHA1:	A393C363B85867F6A94A075510069955DEAD4D28
SHA-256:	1298173E4391C6710DA8D0804968F6FE88D90A203CF040F0209578F274B2D353
SHA-512:	681E68086E393996C016529AF5AA51CB3A3C56AD2F22081CD519B998B1F827E8287C898661AB0AD8145B6D4449A8DA2B2B8F36B2F1AB6F202185CA388DB484BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	.ELF..............>......g......@.......x...........@.8...@.............@.......@.......@........................................................................................................................N.......N.......................P.......P.......P.......F.......F..............................................................................p.......p.......p........t......8.............................................................................8.......8.......8....... ....... .......................X.......X.......X.......D.......D...............S.td....8.......8.......8....... ....... ...............P.td............................$.......$...............Q.td....................................................R.td....p.......p.......p.............................../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU....P.':......#.*X..'............GNU.........................................................(....e.mfUa.9..3...................

/run/mount/utab.0RkakR

Download File

Process:	/bin/umount
File Type:	ASCII text
Category:	dropped
Size (bytes):	267
Entropy (8bit):	5.053737638413987
Encrypted:	false
SSDEEP:	6:zYaO5L+DxYZzh9BFyOIUtYZbZh9BFyOU4YZrdRh9BFKmAbUyOTQXstYX84V+YTN:zBq+tMNjFydUtMbfjFyR4MljF3AbXOTC
MD5:	ABF6208261DCEAEE37C7203350E65FD3
SHA1:	3F3100A46429389F91CC833EF4011FB0CAE41D82
SHA-256:	9F6B507E54CAEA6797395912905D3ADB8CC301C366B6C81E9BCFBD9AC7FACAA0
SHA-512:	F83C8CC41B7204845275474C5C88AE4672A8DA66DA802B3797503F3C988AD355F73A79FEE7A4DEC0ED5C25CCA23F74266299E128789156651032149492637614
Malicious:	false
Preview:	SRC=/dev/loop3 TARGET=/snap/snapd/12704 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop2 TARGET=/snap/lxd/21029 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop6 TARGET=/snap/snapd/12883 ROOT=/ OPTS=x-gdu.hide.SRC=//192.168.2.1/esxi07-Ubuntu20 TARGET=/var/jbx/shared ROOT=/ OPTS=user=guest.

/run/mount/utab.PpIGfr

Download File

Process:	/bin/umount
File Type:	ASCII text
Category:	dropped
Size (bytes):	454
Entropy (8bit):	5.047256427519798
Encrypted:	false
SSDEEP:	12:zBoMcjFyq+tMNjFydUtMbfjFyR4MljFyf0MXgjFyZMbUjF3AbXOTQXgN6:+FyqrFydUALFyjFyjAFys0FQbXOTQXq6
MD5:	090AC935DA95E8E985AA865175EB3928
SHA1:	6249D23199C8458DAF2E392CE41DF6C329B33480
SHA-256:	A76289DD7A3416347B34044921AA163B9C406E51700A50AA499A10291842E807
SHA-512:	65945B377FC3D3DA05E304E05855F871BC2C824166064A87302EC2E23AB6F8EB2609EACF3A97962EEB778ED9AA331A46252AD76BE4F34E2285AA96D0B9405469
Malicious:	false
Preview:	SRC=/dev/loop0 TARGET=/snap/core18/2128 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop3 TARGET=/snap/snapd/12704 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop2 TARGET=/snap/lxd/21029 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop6 TARGET=/snap/snapd/12883 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop4 TARGET=/snap/core20/1081 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop7 TARGET=/snap/lxd/21545 ROOT=/ OPTS=x-gdu.hide.SRC=//192.168.2.1/esxi07-Ubuntu20 TARGET=/var/jbx/shared ROOT=/ OPTS=user=guest.

/run/mount/utab.TSqf9Z

Download File

Process:	/bin/umount
File Type:	ASCII text
Category:	dropped
Size (bytes):	330
Entropy (8bit):	5.055202476458931
Encrypted:	false
SSDEEP:	6:zYaO5L+DxYZzh9BFyOIUtYZbZh9BFyOU4YZrdRh9BFyO6xd0YZoK8h9BFKmAbUyD:zBq+tMNjFydUtMbfjFyR4MljFyf0MXgu
MD5:	B04B5A12843AACA56979FDC9436901F4
SHA1:	A42F5095DD57DF54180BB6602CC5CF84DFAB7D1F
SHA-256:	1DDD692EC6775438B60277B47296C7D4AECBDA85FE9CA3383C4C93AA516857BD
SHA-512:	861BA8E0EE4759FF8AEC10102DDF44B574F4DD2691FB95AED70BC048A4DE8337C485E3644EB35B9EC29BF8394AFF7F401498066DBC163DC6C650ED9C7C9DC22F
Malicious:	false
Preview:	SRC=/dev/loop3 TARGET=/snap/snapd/12704 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop2 TARGET=/snap/lxd/21029 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop6 TARGET=/snap/snapd/12883 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop4 TARGET=/snap/core20/1081 ROOT=/ OPTS=x-gdu.hide.SRC=//192.168.2.1/esxi07-Ubuntu20 TARGET=/var/jbx/shared ROOT=/ OPTS=user=guest.

/run/mount/utab.mPymFi

Download File

Process:	/bin/umount
File Type:	ASCII text
Category:	dropped
Size (bytes):	80
Entropy (8bit):	4.965111376837558
Encrypted:	false
SSDEEP:	3:zYymAbUyOKwlQXstYJJfXAB4COx/mYCQAo:zYymAbUyOTQXstYX84V+YTN
MD5:	8EC6E5BE589D936E6B551A5A651291D9
SHA1:	FAC7B0CCE54453D5134AD17AB642D0EA6C7C7B1D
SHA-256:	EA674541342220DD6C9C3AE2A8F7675418571BF533691C41FA603F0DB9A8772D
SHA-512:	CD192287EB378F420616A76D36D3C86F51DF9A49DB1A8228B75364A07EC67B245F6BD9ACF4F4888AE1735872BF423CD76DAD38FEA916D82CFC01319C47A659F8
Malicious:	false
Preview:	SRC=//192.168.2.1/esxi07-Ubuntu20 TARGET=/var/jbx/shared ROOT=/ OPTS=user=guest.

/run/mount/utab.n01RHn

Download File

Process:	/bin/umount
File Type:	ASCII text
Category:	dropped
Size (bytes):	143
Entropy (8bit):	5.095692072231952
Encrypted:	false
SSDEEP:	3:zYaAV5L+igxYZEcFXScqvOx/KC9BA4SPmAbUyOKwlQXstYJJfXAB4COx/mYCQAo:zYaO5L+DxYZzh9BFKmAbUyOTQXstYX86
MD5:	F38A781D39D03537A8F47010D013A17A
SHA1:	7B2BB19821CD08A103149C9A9103E46ED8E33A71
SHA-256:	12FE1B173722490E8A80044048F8FF27DFB1D5D619E85AF1E0D4A3E494EE27C6
SHA-512:	4A5517FE4BF27B8A03901E59806AA1BF51861B644FD5EE87F3411D56FAFE536ACCE3AA91544880CFB1FCF077D7D08F94C9AA12E33C052E9463C475C0CE889A60
Malicious:	false
Preview:	SRC=/dev/loop3 TARGET=/snap/snapd/12704 ROOT=/ OPTS=x-gdu.hide.SRC=//192.168.2.1/esxi07-Ubuntu20 TARGET=/var/jbx/shared ROOT=/ OPTS=user=guest.

/run/mount/utab.peWoDX

Download File

Process:	/bin/umount
File Type:	ASCII text
Category:	dropped
Size (bytes):	206
Entropy (8bit):	5.079707924769709
Encrypted:	false
SSDEEP:	6:zYaO5L+DxYZzh9BFyOU4YZrdRh9BFKmAbUyOTQXstYX84V+YTN:zBq+tMNjFyR4MljF3AbXOTQXgN6
MD5:	BDA83AEE2688287896F35A67F0AD2B20
SHA1:	C1EA313091EB03E149BFB805533B22EE96447B35
SHA-256:	77A0BB4EDBD73B9EF160B5F9DC9D706220B905C5884A09C75479C52DCF8364F3
SHA-512:	32D289E238087BF6924CBD8F99307DF426DADA52CEE8484CAA68EA98D9A87526E8D19754B9A9A932912C43384C023574D6D8BCAF36D418819B6507433FF1AFF8
Malicious:	false
Preview:	SRC=/dev/loop3 TARGET=/snap/snapd/12704 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop6 TARGET=/snap/snapd/12883 ROOT=/ OPTS=x-gdu.hide.SRC=//192.168.2.1/esxi07-Ubuntu20 TARGET=/var/jbx/shared ROOT=/ OPTS=user=guest.

/run/mount/utab.y4iHnw

Download File

Process:	/bin/umount
File Type:	ASCII text
Category:	dropped
Size (bytes):	391
Entropy (8bit):	5.056383144267748
Encrypted:	false
SSDEEP:	12:zBq+tMNjFydUtMbfjFyR4MljFyf0MXgjFyZMbUjF3AbXOTQXgN6:UrFydUALFyjFyjAFys0FQbXOTQXq6
MD5:	F8CA14CA815831BE5B7A15408EAFE24B
SHA1:	0FACD3D4EA69284FC3BCA1C64804D3D515B28EE1
SHA-256:	60FB93001A1F2116AF89C6D10937BBD2B71BB803D3CAFC08C4C76E2E77976025
SHA-512:	5583840FFDC9CE8575624AC4A425EA9C8FAB8738C2AFF9072C2F57C16EECEA364A190D0C65129D363728C8D3668B2DC2F8FD3FF2C9D8A4F97328CEEF7A44B95D
Malicious:	false
Preview:	SRC=/dev/loop3 TARGET=/snap/snapd/12704 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop2 TARGET=/snap/lxd/21029 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop6 TARGET=/snap/snapd/12883 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop4 TARGET=/snap/core20/1081 ROOT=/ OPTS=x-gdu.hide.SRC=/dev/loop7 TARGET=/snap/lxd/21545 ROOT=/ OPTS=x-gdu.hide.SRC=//192.168.2.1/esxi07-Ubuntu20 TARGET=/var/jbx/shared ROOT=/ OPTS=user=guest.

/run/utmp

Download File

Process:	/lib/systemd/systemd-update-utmp
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.867405675326637
Encrypted:	false
SSDEEP:	3:kl73MCnFtllotRIDuN/PzlX:swC3lutRIuN/Pzl
MD5:	224521E88EDC0BEFCE5572FBBC6343A8
SHA1:	25E2687E16C66D3C69CD50F2105638169936B656
SHA-256:	38D1C94F779A7A8AEA84A28E81950F1523791C09685778DDF17FDFD89D9A4340
SHA-512:	188091D3C14E0F531E096D95099B6249227426090E5CC017F749B3B0386BC0D43E6CC566252AF087114FE792D6D991C9DC4A533611EC257A1283B0824FFD0454
Malicious:	false
Preview:	........~...............................~~..shutdown........................5.4.0-72-generic..........................................................................................................................................................................................................................................................e.......................................

/tmp/.ICE-unix/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/.Test-unix/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/.X11-unix/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/.XIM-unix/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/.font-unix/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/.xfsm-ICE-S33I80

Download File

Process:	/tmp/C.Linux.elf
File Type:	data
Category:	dropped
Size (bytes):	1929
Entropy (8bit):	7.897496358351199
Encrypted:	false
SSDEEP:	48:S3wzIb+4myO+uoTPip7xqRZNlCrgZXcL8QpW4x6Dsn70qFQIuOW:SAzL4bOt2PgeySXcLNg4x6Ds70qFQ1OW
MD5:	490B21A998D46E74C0A5CFF82E020E77
SHA1:	3BDA0BCF9E1E5C49470DE680A0459DF17AC3933E
SHA-256:	34FD380DA659E32A2768571DC9597F4A3AE67E6BA07EB2DD1F1981BC51D0D988
SHA-512:	22F9A8AC1ED8EC842002ED9EE0750861DF7E816173BA3426465420EFC98F4F715CACFFE6E71E6102E86ECAB614245B0800C55DF91B3D00C92C315563182C57F0
Malicious:	false
Preview:	p..>....P.0.p.G.pe.P ..L<.w ..#.J...:..e.q.h....81&....hCTF.]0...U.$.._G...Hd.0.B..A&.k`....'..u....z\|....Y.\........7..TMf.".Y.x.N..{.wG.dlE.t.G...Z.B..L..+..e[-.....a.......W.YA@..Fn...M.+.......~..V...H$.B......;....vZ.....,.R9......cl...;F....B..\....X.. .I.&\..T..R.[W>..a.{\|.:.....I..j.k.N.../-Sz...y?..".....z.......Y..>47>..`.ml..)Gd.{..#V...\-5.....i...#XT.e...W.#CF.F.a.c..VR............D....'..[Z..('.7..'....%w.,.,..=YW[.lo}...:^..x..yx.X^Z.d=/m].K......,m.}.>I..j.V.w.[...U._}..ikh..W.4.....Zy....?O.b.<.=r}..Z......DY..jV.. 1..~p.s.6jW].nG..+....+.."..'R..].~`Y(...D.M...S.y....(.mV-0{....,.M.....Sf..\|V.T.u.+.=.w..TeR.Sh..`..A.YR.I!.......Z...TYW...S..d......a..s.~..H0.5a....I....H....T.....9]:0.2...5...-F..\...5xL..:..:zU.xY.S..sQ..z...U.3.L..G./SS....zA...z....(.n.c.i..w.9...9..!..T..7....I.....UU.r....>....N..$..[.rU6tn.OX?....f......A+...u....y...}".A7ltb....D._..2R..nHG..@0.ke.....8[T?....*..9e...KQ...o..

/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/config-err-dHT8bZ

Download File

Process:	/tmp/C.Linux.elf
File Type:	gzip compressed data, original size modulo 2^32 4098
Category:	dropped
Size (bytes):	1515
Entropy (8bit):	7.854941914832741
Encrypted:	false
SSDEEP:	24:X+suoTPKtXHA2L5r5xqiyZNlCn6fs5fhRgZPEiobNN8QJbTWC7x/PqoCoqUVn70b:XvuoTPip7xqRZNlCrgZXcL8QpW4x6Ds2
MD5:	81544691BAD503A6EC6B2917257041FC
SHA1:	A3E4AEFACBBBFB7643056B01575C7A265DA386EB
SHA-256:	9119391BF2459530403573CFA6D771DE5D312718673CD9510C2C47814CF0BD04
SHA-512:	DC266729305CD8D1F28928C6157D2D283E58A7AA73987358798627AFA6F589523DA066F0AD2AF4829C51211BA76F40A651CF934138224102C66362E97C106019
Malicious:	false
Preview:	..........D....'..[Z..('.7..'....%w.,.,..=YW[.lo}...:^..x..yx.X^Z.d=/m].K......,m.}.>I..j.V.w.[...U._}..ikh..W.4.....Zy....?O.b.<.=r}..Z......DY..jV.. 1..~p.s.6jW].nG..+....+.."..'R..].~`Y(...D.M...S.y....(.mV-0{....,.M.....Sf..\|V.T.u.+.=.w..TeR.Sh..`..A.YR.I!.......Z...TYW...S..d......a..s.~..H0.5a....I....H....T.....9]:0.2...5...-F..\...5xL..:..:zU.xY.S..sQ..z...U.3.L..G./SS....zA...z....(.n.c.i..w.9...9..!..T..7....I.....UU.r....>....N..$..[.rU6tn.OX?....f......A+...u....y...}".A7ltb....D._..2R..nHG..@0.ke.....8[T?......9e...KQ...o.....>\|9[.'U...EgV..>.Q.8.:s....BD..C5G..X.{..^...u..L.....T<......u....K.....G..s..=...jQ8.nt....d2....D..b....%P`med.q............].X.:S.2:AT......*.q.8._'...U.Z...G..%.6i.....&...}tu....h..../.......\|m.B7...8..K.F.(U......h.l..........t.MM+....u.!.k......;..Z+..}2..O..C#EQ..O...O...\|z.{.8.g..5......:M.V.....~4....h..,j..T..q...S....Gd.)..e.c..N.."...7....}..7............0.o2.3h....u.........

/tmp/hsperfdata_root/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/sh-thd.1gsfcp

Download File

Process:	/sbin/blkdeactivate
File Type:	ASCII text
Category:	dropped
Size (bytes):	309
Entropy (8bit):	4.338297764878009
Encrypted:	false
SSDEEP:	6:Lnpd3ZC8yqbbFQxJzjNLoK/BK+ApF3QqxR3ADHOc6Wv:XZtnEpjNLX/BpAzCOc6o
MD5:	3178DF3DE708E9FD158FCF709752F37E
SHA1:	3565C9721975A95D85F3EBC9317E0C8297B71F84
SHA-256:	43D9336DAE3514A3AF71D2D24CC582220A8F9DB5334330A09C7F0CBAE9549570
SHA-512:	8A7FED0A3FB7A8A55D0FA67170DA832522299F7BD3A5B27D912E60A69D06636AA042CBD09069EEE9C13018DCBA7F2B318936165CBBDA6C56BD1F9BDFCB6E3827
Malicious:	false
Preview:	loop loop6 loop6 /snap/snapd/12883.loop loop3 loop3 /snap/snapd/12704.loop loop7 loop7 /snap/lxd/21545.loop loop2 loop2 /snap/lxd/21029.loop loop4 loop4 /snap/core20/1081.loop loop0 loop0 /snap/core18/2128.loop loop1 loop1 /snap/core18/1944.part sda2 sda2 /boot.lvm dm-0 ubuntu--vg-ubuntu--lv /.disk sda sda .

/tmp/sh-thd.Q33CHr

Download File

Process:	/sbin/blkdeactivate
File Type:	ASCII text
Category:	dropped
Size (bytes):	354
Entropy (8bit):	4.365286938387033
Encrypted:	false
SSDEEP:	6:9BK+ApF3BFbbFQgZNJzjNLoKZnpd38IXRsE7WsWxR3bF8DHOIjWo:9BpAhFlPZNpjNLXiIBhtELMOIp
MD5:	97B712A91CC5EC5253372C653767667A
SHA1:	71BFF6CC8FABC59E35F2CE99F1FB3FE7C5308E67
SHA-256:	17D4CF057F4E5699F2F4D1273012F755F4C7931F80822DEC48007C039D0B4C41
SHA-512:	A68913EC0C694D456F2BE6BC4599BFEA890F6D0FB3F2196D7DD1BCF6E3D69810C0A51212725A52F42968BE66C557380FD141E7709F8DFE4945829DD7C0E74ADC
Malicious:	false
Preview:	loop loop0 loop0 /snap/core18/2128.loop loop1 loop1 /snap/core18/1944.loop loop2 loop2 /snap/lxd/21029.loop loop3 loop3 /snap/snapd/12704.loop loop4 loop4 /snap/core20/1081.loop loop6 loop6 /snap/snapd/12883.loop loop7 loop7 /snap/lxd/21545.part sda1 sda1 .disk sda sda .part sda2 sda2 /boot.rom sr0 sr0 .lvm dm-0 ubuntu--vg-ubuntu--lv /.part sda3 sda3 .

/tmp/snap.lxd/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/snap.lxd/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/ssh-hOQ5FjG2iVgO/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	true
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-ModemManager.service-c4RYFi/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-gKIF8e/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-colord.service-gKIF8e/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-fwupd.service-gB0a9f/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-APWnLg/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-switcheroo-control.service-APWnLg/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-logind.service-IofUpj/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzg/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-resolved.service-AfPZzg/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-timedated.service-sHLxhi/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-systemd-timedated.service-sHLxhi/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/systemd-private-ec795e01d534441298b2bf519e4c51fc-upower.service-x0xO0i/tmp/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/tmp/vmware-root_721-4290559889/README_TO_DECRYPT.txt

Download File

Process:	/tmp/C.Linux.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	1621
Entropy (8bit):	4.655076392749516
Encrypted:	false
SSDEEP:	24:i+85byuppKmaWsZkRhtjLFp6HxErO8krORlxdwSwkjXARl2axi7JT7C:QZy2CuD9qH8l4zsA2a07JT7C
MD5:	D67F69BFFB5C86A83AE1A2EDDA5B8616
SHA1:	1E23E13D9C6A76A7B088A64E396A8983486CA24F
SHA-256:	90D95D6EDF20E2A937DFEEA963C06593D90CEBB199FC5820B7A2D66C3402D913
SHA-512:	1AAB449240EB0D929AC3AE14B70F3C95D04B4FE6D66DC51B0132C3772E69FB173877EAC5C8ECB882A3E1A7337E9B0295515359CA19F730C9E91CFD64464ABA4B
Malicious:	false
Preview:	Your network has been compromised! All your important data has been encrypted!..There is only one way to get your data back to normal:..1. Contact us as soon as possible to avoid damages and losses from your business..2. Send to us any encrypted file of your choice and your personal key..3. We will decrypt 1 file for test (maximum file size = 1 MB), its guaranteed that we can decrypt your files..4. Pay the amount required in order to restore your network back to normal..5. We will then send you our software to decrypt and will guide you through the whole restoration of your network...We prefer Monero (XMR) - FIXED PRICE.We accept Bitcoin (BTC) - 20% extra of total payment!..============================================================================================================================..WARNING!.Do not rename encrypted data..Do not try to decrypt using third party software, it may cause permanent data loss not being able to recover...========================================

/var/cache/motd-news

Download File

Process:	/usr/bin/cut
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	4.493616814343774
Encrypted:	false
SSDEEP:	3:P2xxS8/vSAX9qEWpFuEb3c6uGlHY4/4tA9piBFH3guUFuRz5/D0VTFA9PyLOurAn:OlpqEWpFuEb3BlHLbmHwlFeWvL3rA9x
MD5:	CBDCED8720CAB6EEBEF7861E8ADAE665
SHA1:	6D06B520D347AAD2775CAA9AF7852D26347E33D0
SHA-256:	D90D574CFCD9A7C941F9B1385434460F49ED9A2E8C0069C43DD05BA4453087E0
SHA-512:	4DB4E08D47327057A50C0349774A3F31B94C72438D59FB7E3BA8A4F04C519ECF6943CDF4846AB682C2A03CEB83D2840E7389DD5E175F8B3FF12EC06C198A52D2
Malicious:	false
Preview:	* Strictly confined Kubernetes makes edge and IoT secure. Learn how MicroK8s. just raised the bar for easy, resilient and secure K8s cluster deployment... https://ubuntu.com/engage/secure-kubernetes-at-the-edge.

/var/jbx/shared/logs/dmesg.log

Download File

Process:	/tmp/C.Linux.elf
File Type:	data
Category:	dropped
Size (bytes):	1956
Entropy (8bit):	7.880629660216875
Encrypted:	false
SSDEEP:	48:qI9AfPAf1FeHuoTPip7xqRZNlCrgZXcL8QpW4x6Dsn70qFQIuOW:r5dFeO2PgeySXcLNg4x6Ds70qFQ1OW
MD5:	13CF08B704150A54F33B0CE96A8D5F97
SHA1:	A49E77E9351D88F9405B8F01AA686AC23201B95E
SHA-256:	B9814F1D11C9C848F0B59AA654AD9582E892FF7689530BBE822C1C3AD2D39C18
SHA-512:	090ADC60E5CE2A3975627680D4740425915A3946D6493282D54668FD10188CB8B5A09C81C873009A5ADD897F92026C8B29F8652B23859B058E5AC5476202E5AC
Malicious:	false
Preview:	YX.bK....Ps.-...shl.u#}..S..eW..>0..$i`.<).^.J._...:3.t.....T..O..._,...b<..A..B..w....:.4..C<...r:.[...Z.JD/..Y....<...J\!...A^..b..-TN.Kt...J.7.M...w..9.t....y...C...>.....\|.5.../9.y..c.y.....C..o.@.al.2..T...nM.g.....W...yR.W....V5.B......M..[j^...d.-+:...f...S.....kz.D.K........_...m...U...<H.(......nt....% km...o............O....r....)).5...P.Pb.Qu.dc...g._.$....'Z....}..:k..X.......v?L..6(...Z.Q.=.............D....'..[Z..('.7..'....%w.,.,..=YW[.lo}...:^..x..yx.X^Z.d=/m].K......,m.}.>I..j.V.w.[...U._}..ikh..W.4.....Zy....?O.b.<.=r}..Z......DY..jV.. 1..~p.s.6jW].nG..+....+.."..'R..].~`Y(...D.M...S.y....(.mV-0{....,.M.....Sf..\|V.T.u.+.=.w..TeR.Sh..`..A.YR.I!.......Z...TYW...S..d......a..s.~..H0*.5a....I....H....T.....9]:0.2...5...-F..\...5xL..:..:zU.xY.S..sQ..z...U.3.L..G./SS....zA...z....(.n.c.i..w.9...9..!..T..7....I.....UU.r....>....N..$..[.rU6tn.OX?....f......A+...u....y...}".A7ltb....D._..2R..nHG..@0.ke.....8

/var/lib/systemd/random-seed

Download File

Process:	/lib/systemd/systemd-random-seed
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	7.610152765984688
Encrypted:	false
SSDEEP:	12:OQcvYJdiCN9aYolI7n9xstyKIUTCgBWg/ooF:OQTJgY9n9SqgQS
MD5:	36E8D12BCDEF06A38A480168A3B50052
SHA1:	17D55210D2B2A71BEDC5F954C40D0681D0E61AF0
SHA-256:	8FD9537BF05548A5D431B9B2150E60D6A5CCDC1BA069FBAC2CB089A1C5F50EA1
SHA-512:	529FAAFA12F745C28D0B55ECFF2FA6F9EE032D304C82892183E794A1B1F2F9EAF8F7463E215A5B31D6F6C9E6ECCFF771B90632604B34C6C06FF5122F51923C82
Malicious:	false
Preview:	<A..$fU....X./s..<o.....DP.u!...w-.....n..?.#H..vL.5.._1..{O....7?....s....W`$u.....A..Hb......B..\|-.....$....aR<.}.0b....._.[.~...M..7.gp\|._...C\|.UqVgZ....w..s3......(.n.t.>..s...h.......! k.R.m.7......b....e.8.U.-....FqQE`.P..j\|...X.`.Osp.....l.V....'w.>........P._%"."..V>....56.........q.m4.8.....7......R...x.~[.........iq...3....#oh...lP...19...B6...'...z.....e.....j.............8.~...*..w..~.T...,o.cV,...t....;...i..~.5CK..=.E.+.s...#!.......k........O.j....5.,.O...SP

/var/log/wtmp

Download File

Process:	/lib/systemd/systemd-update-utmp
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.867405675326637
Encrypted:	false
SSDEEP:	3:kl73MCnFtllotRIDuN/PzlX:swC3lutRIuN/Pzl
MD5:	224521E88EDC0BEFCE5572FBBC6343A8
SHA1:	25E2687E16C66D3C69CD50F2105638169936B656
SHA-256:	38D1C94F779A7A8AEA84A28E81950F1523791C09685778DDF17FDFD89D9A4340
SHA-512:	188091D3C14E0F531E096D95099B6249227426090E5CC017F749B3B0386BC0D43E6CC566252AF087114FE792D6D991C9DC4A533611EC257A1283B0824FFD0454
Malicious:	false
Preview:	........~...............................~~..shutdown........................5.4.0-72-generic..........................................................................................................................................................................................................................................................e.......................................

Source: C.Linux.elf	ReversingLabs: Detection: 57%
Source: C.Linux.elf	Virustotal: Detection: 57%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42

Source: grep.516.dr	String found in binary or memory: http://www.gnu.org/software/grep/
Source: grep.516.dr	String found in binary or memory: http://www.gnu.org/software/grep/General
Source: grep.516.dr	String found in binary or memory: https://git.sv.gnu.org/cgit/grep.git/tree/AUTHORS
Source: sleep.590.dr, expr.778.dr, grep.516.dr	String found in binary or memory: https://gnu.org/licenses/gpl.html
Source: grep.516.dr	String found in binary or memory: https://gnu.org/licenses/gpl.htmlWritten
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp, README_TO_DECRYPT.txt20.28.dr, README_TO_DECRYPT.txt12.28.dr, README_TO_DECRYPT.txt24.28.dr, README_TO_DECRYPT.txt19.28.dr, README_TO_DECRYPT.txt13.28.dr, README_TO_DECRYPT.txt.28.dr, README_TO_DECRYPT.txt25.28.dr, README_TO_DECRYPT.txt6.28.dr, README_TO_DECRYPT.txt5.28.dr, README_TO_DECRYPT.txt2.28.dr, README_TO_DECRYPT.txt15.28.dr, README_TO_DECRYPT.txt11.28.dr, README_TO_DECRYPT.txt4.28.dr, README_TO_DECRYPT.txt23.28.dr, README_TO_DECRYPT.txt18.28.dr, README_TO_DECRYPT.txt21.28.dr, README_TO_DECRYPT.txt9.28.dr, README_TO_DECRYPT.txt10.28.dr, README_TO_DECRYPT.txt0.28.dr, README_TO_DECRYPT.txt1.28.dr	String found in binary or memory: https://qtox.github.io
Source: C.Linux.elf, 6222.1.0000000009c00000.000000000a200000.rw-.sdmp, README_TO_DECRYPT.txt20.28.dr, README_TO_DECRYPT.txt12.28.dr, README_TO_DECRYPT.txt24.28.dr, README_TO_DECRYPT.txt19.28.dr, README_TO_DECRYPT.txt13.28.dr, README_TO_DECRYPT.txt.28.dr, README_TO_DECRYPT.txt25.28.dr, README_TO_DECRYPT.txt6.28.dr, README_TO_DECRYPT.txt5.28.dr, README_TO_DECRYPT.txt2.28.dr, README_TO_DECRYPT.txt15.28.dr, README_TO_DECRYPT.txt11.28.dr, README_TO_DECRYPT.txt4.28.dr, README_TO_DECRYPT.txt23.28.dr, README_TO_DECRYPT.txt18.28.dr, README_TO_DECRYPT.txt21.28.dr, README_TO_DECRYPT.txt9.28.dr, README_TO_DECRYPT.txt10.28.dr, README_TO_DECRYPT.txt0.28.dr, README_TO_DECRYPT.txt1.28.dr	String found in binary or memory: https://tox.chat/download.html
Source: expr.778.dr	String found in binary or memory: https://translationproject.org/team/
Source: motd-news.18.dr	String found in binary or memory: https://ubuntu.com/engage/secure-kubernetes-at-the-edge
Source: sleep.590.dr, expr.778.dr, grep.516.dr	String found in binary or memory: https://www.gnu.org/gethelp/
Source: grep.516.dr	String found in binary or memory: https://www.gnu.org/gethelp/License
Source: sleep.590.dr, expr.778.dr	String found in binary or memory: https://www.gnu.org/software/coreutils/
Source: sleep.590.dr, expr.778.dr	String found in binary or memory: https://www.gnu.org/software/coreutils/Report

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

Source: /tmp/C.Linux.elf	File dropped: /tmp/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/.ICE-unix/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/.Test-unix/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/.X11-unix/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/.XIM-unix/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/.font-unix/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/hsperfdata_root/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/snap.lxd/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/snap.lxd/tmp/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file
Source: /tmp/C.Linux.elf	File dropped: /tmp/ssh-hOQ5FjG2iVgO/README_TO_DECRYPT.txt -> encrypted!there is only one way to get your data back to normal:1. contact us as soon as possible to avoid damages and losses from your business.2. send to us any encrypted file of your choice and your personal key.3. we will decrypt 1 file for test (maximum file size = 1 mb), its guaranteed that we can decrypt your files.4. pay the amount required in order to restore your network back to normal.5. we will then send you our software to decrypt and will guide you through the whole restoration of your network.we prefer monero (xmr) - fixed pricewe accept bitcoin (btc) - 20% extra of total payment!============================================================================================================================warning!do not rename encrypted data.do not try to decrypt using third party software, it may cause permanent data loss not being able to recover.============================================================================================================================contac	Jump to dropped file

Source: /sbin/lvm (PID: 6234)	File: /proc/6234/mounts			Jump to behavior
Source: /bin/fusermount (PID: 6275)	File: /proc/6275/mounts			Jump to behavior

Source: /sbin/blkdeactivate (PID: 6279)	Grep executable: /usr/bin/grep -> grep -- --all-targets	Jump to behavior
Source: /sbin/blkdeactivate (PID: 6292)	Grep executable: /usr/bin/grep -> grep running	Jump to behavior
Source: /usr/bin/finalrd (PID: 6289)	Grep executable: /usr/bin/grep -> grep -Eow /.ld-..so /proc/self/maps	Jump to behavior
Source: /usr/bin/finalrd (PID: 6301)	Grep executable: /usr/bin/grep -> grep -Eow "/.* "	Jump to behavior
Source: /usr/bin/finalrd (PID: 6305)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libc.so.6 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6311)	Grep executable: /usr/bin/grep -> grep -q /lib64/ld-linux-x86-64.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6321)	Grep executable: /usr/bin/grep -> grep -q /usr/lib/x86_64-linux-gnu/ld-2.31.so /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6328)	Grep executable: /usr/bin/grep -> grep -Eow "/.* "	Jump to behavior
Source: /usr/bin/finalrd (PID: 6329)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libc.so.6 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6334)	Grep executable: /usr/bin/grep -> grep -q /lib/systemd/libsystemd-shared-245.so /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6336)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libmount.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6340)	Grep executable: /usr/bin/grep -> grep -q /lib64/ld-linux-x86-64.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6344)	Grep executable: /usr/bin/grep -> grep -q /usr/lib/x86_64-linux-gnu/ld-2.31.so /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6345)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libacl.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6349)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libblkid.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6353)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libcap.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6357)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libcrypt.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6361)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libcryptsetup.so.12 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6365)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libgcrypt.so.20 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6369)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libidn2.so.0 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6373)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libip4tc.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6377)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libkmod.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6381)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/liblz4.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6385)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libpam.so.0 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6389)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/librt.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6393)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libseccomp.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6397)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libselinux.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6399)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/liblzma.so.5 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6405)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libpthread.so.0 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6409)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libuuid.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6413)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libdevmapper.so.1.02.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6415)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libcrypto.so.1.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6417)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libargon2.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6419)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libjson-c.so.4 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6423)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libgpg-error.so.0 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6427)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libunistring.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6431)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libaudit.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6435)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libdl.so.2 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6439)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libpcre2-8.so.0 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6443)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libudev.so.1 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6447)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libm.so.6 /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6451)	Grep executable: /usr/bin/grep -> grep -q /lib/x86_64-linux-gnu/libcap-ng.so.0 /run/finalrd-libs.conf	Jump to behavior

Source: /usr/share/finalrd/mdadm.finalrd (PID: 6459)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/sbin	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6491)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/sbin	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6519)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6558)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/bin	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6578)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6581)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6607)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/bin	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6633)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/sbin	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6654)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/lib/x86_64-linux-gnu	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6668)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/sbin	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6738)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//usr/bin	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6764)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//etc/iscsi	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6766)	Mkdir executable: /usr/bin/mkdir -> mkdir -p /run/initramfs//etc/iscsi	Jump to behavior

Source: /usr/bin/dash (PID: 6196)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.YcTDHHOxSx /tmp/tmp.W99M6ZYVV2 /tmp/tmp.g2R2JSgaM5	Jump to behavior
Source: /usr/bin/finalrd (PID: 6294)	Rm executable: /usr/bin/rm -> rm -f /run/finalrd-libs.conf	Jump to behavior
Source: /usr/bin/finalrd (PID: 6324)	Rm executable: /usr/bin/rm -> rm -f /run/finalrd-libs.conf	Jump to behavior

Source: /usr/bin/systemd-tmpfiles (PID: 6455)	File: /run/initramfs/shutdown (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/systemd-tmpfiles (PID: 6455)	File: /run/initramfs/usr/bin/dash (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/systemd-tmpfiles (PID: 6455)	File: /run/initramfs/etc/ld.so.conf.d (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/systemd-tmpfiles (PID: 6455)	File: /run/initramfs/usr/lib/x86_64-linux-gnu/libc-2.31.so (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/systemd-tmpfiles (PID: 6455)	File: /run/initramfs/usr/lib/x86_64-linux-gnu/ld-2.31.so (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/systemd-tmpfiles (PID: 6455)	File: /run/initramfs/usr/lib/x86_64-linux-gnu/libpthread-2.31.so (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /usr/bin/finalrd (PID: 6298)	Touch executable: /usr/bin/touch -> touch /run/finalrd-libs.conf			Jump to behavior
Source: /usr/bin/finalrd (PID: 6325)	Touch executable: /usr/bin/touch -> touch /run/finalrd-libs.conf			Jump to behavior

Source: /usr/bin/cp (PID: 6460)	File written: /run/initramfs/usr/sbin/mdadm	Jump to dropped file
Source: /usr/bin/cp (PID: 6492)	File written: /run/initramfs/usr/sbin/mdmon	Jump to dropped file
Source: /usr/bin/cp (PID: 6520)	File written: /run/initramfs/usr/lib/x86_64-linux-gnu/libgcc_s.so.1	Jump to dropped file
Source: /usr/bin/cp (PID: 6559)	File written: /run/initramfs/usr/bin/grep	Jump to dropped file
Source: /usr/bin/cp (PID: 6582)	File written: /run/initramfs/usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3	Jump to dropped file
Source: /usr/bin/cp (PID: 6608)	File written: /run/initramfs/usr/bin/sleep	Jump to dropped file
Source: /usr/bin/cp (PID: 6635)	File written: /run/initramfs/usr/sbin/iscsiadm	Jump to dropped file
Source: /usr/bin/cp (PID: 6655)	File written: /run/initramfs/usr/lib/x86_64-linux-gnu/libisns-nocrypto.so.0	Jump to dropped file
Source: /usr/bin/cp (PID: 6669)	File written: /run/initramfs/usr/sbin/iscsid	Jump to dropped file
Source: /usr/bin/cp (PID: 6739)	File written: /run/initramfs/usr/bin/expr	Jump to dropped file

Source: /usr/bin/cp (PID: 6769)	Writes shell script file to disk with an unusual file extension: /run/initramfs/usr/lib/systemd/system-shutdown/mdadm.finalrd			Jump to dropped file
Source: /usr/bin/cp (PID: 6770)	Writes shell script file to disk with an unusual file extension: /run/initramfs/usr/lib/systemd/system-shutdown/open-iscsi.finalrd			Jump to dropped file

Source: /usr/share/finalrd/mdadm.finalrd (PID: 6463)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6475)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6478)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6481)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6484)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6487)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6490)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6495)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6509)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6512)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6515)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6518)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6523)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6535)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6538)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6541)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6544)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6547)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6550)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6553)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/mdadm.finalrd (PID: 6556)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6562)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6574)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6577)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6585)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6588)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6591)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6594)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6597)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6600)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6603)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6606)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6611)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6623)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6626)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6629)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6632)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6638)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6650)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6653)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6658)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6661)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6664)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6667)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6672)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6684)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6687)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6690)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6693)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6696)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6699)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6702)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6705)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6708)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6711)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6714)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6717)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6720)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6725)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6728)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6731)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6734)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6737)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6742)	Sed executable: /usr/bin/sed -> sed -e "\n\t\t/\\//!d;\n\t\t/linux-gate/d;\n\t\t/=>/ {s/.=>[[:blank:]]\\([^[:blank:]]\\)./\\1/};\n\t\ts/[[:blank:]]\\([^[:blank:]]\\) (.*)/\\1/"	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6754)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6757)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6760)	Sed executable: /usr/bin/sed -> sed -e s#/lib/\\([^/]/\\)\\?\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.*\\)#/lib/\\1\\3#	Jump to behavior
Source: /usr/share/finalrd/open-iscsi.finalrd (PID: 6763)	Sed executable: /usr/bin/sed -> sed -e s#-linux-gnu/\\(tls\\\|i686\\\|sse2\\\|neon\\\|vfp\\)./\\(lib.\\)#-linux-gnu/\\2#	Jump to behavior

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, Go BuildID=iYtIhpAnKGpKCBklvQXAUtrEDIJjKdKIsVIDVBGCkXF, stripped
Entropy (8bit):	6.185196198773661
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	C.Linux.elf
File size:	2'314'240 bytes
MD5:	56cabcf95add39a6feb09391ccc40dcd
SHA1:	84c8921f18a6d7861e842e4edb9c0c96142b5f75
SHA256:	4e153342189a55ffed34a91f2a3f4440af1acbf7dc58135a165a06b4e657556a
SHA512:	d07ebf47260c3aa6307ce96de9241b1e778d446d913f0ca2165827f66020f6198f51da542d74f9cfd23edb82f3cf40b83579d0a29825493c87fe82001793b652
SSDEEP:	49152:mNGaixLBzuog6dUWed4u0HPH94C05PxgeZq1:mN1idhu6dUW
TLSH:	9DB52A51FECB90B6E5031E3144ABA2AF5B356D094F31EB87EA107F1AED37691193620C
File Content Preview:	.ELF........................4...........4. ...(.........4...4...4...................................<...<...........................y...y.................... ... ..T...T.................!...&...&.@....6..........Q.td...............................e.......

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80a85d0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	7
Section Header Offset:	276
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	3

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.text	PROGBITS	0x8049000	0x1000	0x128979	0x0	0x6	AX	16
.rodata	PROGBITS	0x8172000	0x12a000	0x5564e	0x0	0x2	A	32
.shstrtab	STRTAB	0x0	0x17f660	0xa5	0x0	0x0		1
.typelink	PROGBITS	0x81c7720	0x17f720	0x894	0x0	0x2	A	32
.itablink	PROGBITS	0x81c7fc0	0x17ffc0	0xec	0x0	0x2	A	32
.gosymtab	PROGBITS	0x81c80ac	0x1800ac	0x0	0x0	0x2	A	1
.gopclntab	PROGBITS	0x81c80c0	0x1800c0	0x98094	0x0	0x2	A	32
.go.buildinfo	PROGBITS	0x8261000	0x219000	0x120	0x0	0x3	WA	16
.noptrdata	PROGBITS	0x8261120	0x219120	0x16760	0x0	0x3	WA	32
.data	PROGBITS	0x8277880	0x22f880	0x47a8	0x0	0x3	WA	32
.bss	NOBITS	0x827c040	0x234040	0x1407c	0x0	0x3	WA	32
.noptrbss	NOBITS	0x82900c0	0x2480c0	0x4558	0x0	0x3	WA	32
.note.go.buildid	NOTE	0x8048fc4	0xfc4	0x3c	0x0	0x2	A	4

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
PHDR	0x34	0x8048034	0x8048034	0xe0	0xe0	2.8542	0x4	R	0x1000
NOTE	0xfc4	0x8048fc4	0x8048fc4	0x3c	0x3c	4.5106	0x4	R	0x4	.note.go.buildid
LOAD	0x0	0x8048000	0x8048000	0x129979	0x129979	6.0541	0x5	R E	0x1000	.text .note.go.buildid
LOAD	0x12a000	0x8172000	0x8172000	0xee154	0xee154	5.7176	0x4	R	0x1000	.rodata .typelink .itablink .gosymtab .gopclntab
LOAD	0x219000	0x8261000	0x8261000	0x1b040	0x33618	5.6577	0x6	RW	0x1000	.go.buildinfo .noptrdata .data .bss .noptrbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4
LOOS+5041580	0x0	0x0	0x0	0x0	0x0	0.0000	0x2a00		0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 17, 2024 14:23:44.902467012 CET	43928	443	192.168.2.23	91.189.91.42
Jan 17, 2024 14:23:50.537676096 CET	42836	443	192.168.2.23	91.189.91.43
Jan 17, 2024 14:23:52.070904016 CET	42516	80	192.168.2.23	109.202.202.202
Jan 17, 2024 14:24:05.379561901 CET	43928	443	192.168.2.23	91.189.91.42

Start time (UTC):	13:23:36
Start date (UTC):	17/01/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report C.Linux.elf

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Networking

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/ld.so.cache~

/run/.#nologinTrHln5

/run/finalrd-libs.conf

/run/initramfs/etc/initrd-release

/run/initramfs/etc/iscsi/initiatorname.iscsi

/run/initramfs/etc/iscsi/iscsid.conf

/run/initramfs/usr/bin/expr

/run/initramfs/usr/bin/grep

/run/initramfs/usr/bin/sleep

/run/initramfs/usr/lib/systemd/system-shutdown/mdadm.finalrd

/run/initramfs/usr/lib/systemd/system-shutdown/open-iscsi.finalrd

/run/initramfs/usr/lib/x86_64-linux-gnu/libgcc_s.so.1

/run/initramfs/usr/lib/x86_64-linux-gnu/libisns-nocrypto.so.0

/run/initramfs/usr/lib/x86_64-linux-gnu/libpcre.so.3.13.3

/run/initramfs/usr/sbin/iscsiadm

/run/initramfs/usr/sbin/iscsid

/run/initramfs/usr/sbin/mdadm

/run/initramfs/usr/sbin/mdmon

/run/mount/utab.0RkakR

/run/mount/utab.PpIGfr

/run/mount/utab.TSqf9Z

/run/mount/utab.mPymFi

/run/mount/utab.n01RHn

/run/mount/utab.peWoDX

/run/mount/utab.y4iHnw

/run/utmp

/tmp/.ICE-unix/README_TO_DECRYPT.txt

/tmp/.Test-unix/README_TO_DECRYPT.txt

/tmp/.X11-unix/README_TO_DECRYPT.txt

/tmp/.XIM-unix/README_TO_DECRYPT.txt

Linux Analysis Report
C.Linux.elf

Start time (UTC):	13:23:37
Start date (UTC):	17/01/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	13:23:42
Start date (UTC):	17/01/2024
Path:	/tmp/C.Linux.elf
Arguments:	/tmp/C.Linux.elf
File size:	2314240 bytes
MD5 hash:	56cabcf95add39a6feb09391ccc40dcd

Start time (UTC):	13:23:48
Start date (UTC):	17/01/2024
Path:	/tmp/C.Linux.elf
Arguments:	-
File size:	2314240 bytes
MD5 hash:	56cabcf95add39a6feb09391ccc40dcd

Start time (UTC):	13:23:49
Start date (UTC):	17/01/2024
Path:	/sbin/multipathd
Arguments:	/sbin/multipathd show daemon
File size:	129224 bytes
MD5 hash:	73aecbc1c62d72893930e27aa30e66c2

Start time (UTC):	13:23:50
Start date (UTC):	17/01/2024
Path:	/sbin/blkdeactivate
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Start time (UTC):	13:23:51
Start date (UTC):	17/01/2024
Path:	/sbin/blkdeactivate
Arguments:	-
File size:	1183448 bytes
MD5 hash:	7063c3930affe123baecd3b340f1ad2c

Start time (UTC):	13:23:52
Start date (UTC):	17/01/2024
Path:	/usr/bin/finalrd
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	13:23:53
Start date (UTC):	17/01/2024
Path:	/usr/bin/finalrd
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	13:23:54
Start date (UTC):	17/01/2024
Path:	/usr/bin/finalrd
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	13:23:55
Start date (UTC):	17/01/2024
Path:	/usr/bin/finalrd
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c