Edit tour

Linux Analysis Report
Y1TyhqLmmr.elf

Overview

General Information

Sample name:	Y1TyhqLmmr.elf renamed because original name is a hash value
Original sample name:	fa8c6f9157f9748e80a8c76167f5a673.elf
Analysis ID:	1458053
MD5:	fa8c6f9157f9748e80a8c76167f5a673
SHA1:	ddf24385e36214be0337b27f8e5a80bf910413a6
SHA256:	412dde5b06d7bd1c11f90045fc823818a690c87b044c1aa3a86e1a3fe8150f98
Tags:	64elfmirai
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1458053
Start date and time:	2024-06-16 17:49:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	Y1TyhqLmmr.elf renamed because original name is a hash value
Original Sample Name:	fa8c6f9157f9748e80a8c76167f5a673.elf
Detection:	MAL
Classification:	mal92.spre.troj.evad.linELF@0/116@320/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/Y1TyhqLmmr.elf
PID:	6213
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

Y1TyhqLmmr.elf (PID: 6213, Parent: 6129, MD5: fa8c6f9157f9748e80a8c76167f5a673) Arguments: /tmp/Y1TyhqLmmr.elf

Y1TyhqLmmr.elf New Fork (PID: 6214, Parent: 6213)

Y1TyhqLmmr.elf New Fork (PID: 6215, Parent: 6214)

gnome-session-binary New Fork (PID: 6216, Parent: 1477)

sh (PID: 6216, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6216, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6221, Parent: 1)

systemd-hostnamed (PID: 6221, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6317, Parent: 1320)

Default (PID: 6317, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6369, Parent: 1320)

Default (PID: 6369, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6387, Parent: 1)

dbus-daemon (PID: 6387, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gvfsd-fuse New Fork (PID: 6389, Parent: 2038)

fusermount (PID: 6389, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6391, Parent: 1)

dbus-daemon (PID: 6391, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6392, Parent: 1)

rsyslogd (PID: 6392, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6407, Parent: 1)

systemd-logind (PID: 6407, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6469, Parent: 1)

agetty (PID: 6469, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6470, Parent: 1320)

Default (PID: 6470, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6471, Parent: 1)

gpu-manager (PID: 6471, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6472, Parent: 6471)

sh (PID: 6472, Parent: 6471, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6473, Parent: 6472)

grep (PID: 6473, Parent: 6472, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6474, Parent: 6471)

sh (PID: 6474, Parent: 6471, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6475, Parent: 6474)

grep (PID: 6475, Parent: 6474, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6477, Parent: 1)

rsyslogd (PID: 6477, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6478, Parent: 1)

generate-config (PID: 6478, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6479, Parent: 6478)

pkill (PID: 6479, Parent: 6478, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6485, Parent: 1)

dbus-daemon (PID: 6485, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6488, Parent: 1)

journalctl (PID: 6488, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6489, Parent: 1)

agetty (PID: 6489, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6490, Parent: 1)

systemd-journald (PID: 6490, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6493, Parent: 1)

systemd-logind (PID: 6493, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6550, Parent: 1)

rsyslogd (PID: 6550, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6551, Parent: 1)

dbus-daemon (PID: 6551, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6556, Parent: 1)

gpu-manager (PID: 6556, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6557, Parent: 6556)

sh (PID: 6557, Parent: 6556, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6558, Parent: 6557)

grep (PID: 6558, Parent: 6557, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6560, Parent: 6556)

sh (PID: 6560, Parent: 6556, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6561, Parent: 6560)

grep (PID: 6561, Parent: 6560, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6562, Parent: 6556)

sh (PID: 6562, Parent: 6556, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6563, Parent: 6562)

grep (PID: 6563, Parent: 6562, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6565, Parent: 6556)

sh (PID: 6565, Parent: 6556, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6566, Parent: 6565)

grep (PID: 6566, Parent: 6565, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6570, Parent: 6556)

sh (PID: 6570, Parent: 6556, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6571, Parent: 6570)

grep (PID: 6571, Parent: 6570, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6573, Parent: 6556)

sh (PID: 6573, Parent: 6556, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6574, Parent: 6573)

grep (PID: 6574, Parent: 6573, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6577, Parent: 1)

generate-config (PID: 6577, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6579, Parent: 6577)

pkill (PID: 6579, Parent: 6577, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6578, Parent: 1)

rsyslogd (PID: 6578, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6585, Parent: 1)

dbus-daemon (PID: 6585, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6591, Parent: 1)

systemd-logind (PID: 6591, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6650, Parent: 1)

rsyslogd (PID: 6650, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6651, Parent: 1)

dbus-daemon (PID: 6651, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6653, Parent: 1)

gpu-manager (PID: 6653, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6657, Parent: 6653)

sh (PID: 6657, Parent: 6653, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6658, Parent: 6657)

grep (PID: 6658, Parent: 6657, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6661, Parent: 6653)

sh (PID: 6661, Parent: 6653, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6724, Parent: 6661)

grep (PID: 6724, Parent: 6661, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6659, Parent: 1)

systemd-journald (PID: 6659, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6662, Parent: 1)

dbus-daemon (PID: 6662, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6665, Parent: 1)

systemd-logind (PID: 6665, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6722, Parent: 1)

rsyslogd (PID: 6722, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6727, Parent: 1)

generate-config (PID: 6727, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6729, Parent: 6727)

pkill (PID: 6729, Parent: 6727, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6728, Parent: 1)

dbus-daemon (PID: 6728, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6730, Parent: 1)

rsyslogd (PID: 6730, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6737, Parent: 1)

dbus-daemon (PID: 6737, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6738, Parent: 1)

rsyslogd (PID: 6738, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6740, Parent: 1)

systemd-journald (PID: 6740, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6742, Parent: 1)

dbus-daemon (PID: 6742, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6745, Parent: 1)

systemd-logind (PID: 6745, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6802, Parent: 1)

gpu-manager (PID: 6802, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6806, Parent: 6802)

sh (PID: 6806, Parent: 6802, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6807, Parent: 6806)

grep (PID: 6807, Parent: 6806, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6810, Parent: 6802)

sh (PID: 6810, Parent: 6802, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6814, Parent: 6810)

grep (PID: 6814, Parent: 6810, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6816, Parent: 6802)

sh (PID: 6816, Parent: 6802, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6817, Parent: 6816)

grep (PID: 6817, Parent: 6816, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6803, Parent: 1)

dbus-daemon (PID: 6803, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6804, Parent: 1)

rsyslogd (PID: 6804, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6819, Parent: 1)

generate-config (PID: 6819, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6821, Parent: 6819)

pkill (PID: 6821, Parent: 6819, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6820, Parent: 1)

dbus-daemon (PID: 6820, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6822, Parent: 1)

rsyslogd (PID: 6822, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6824, Parent: 1)

systemd-journald (PID: 6824, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6828, Parent: 1)

systemd-logind (PID: 6828, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6853, Parent: 1)

dbus-daemon (PID: 6853, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6886, Parent: 1)

rsyslogd (PID: 6886, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6888, Parent: 1)

dbus-daemon (PID: 6888, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6889, Parent: 1)

rsyslogd (PID: 6889, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6891, Parent: 1)

gpu-manager (PID: 6891, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6892, Parent: 6891)

sh (PID: 6892, Parent: 6891, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6893, Parent: 6892)

grep (PID: 6893, Parent: 6892, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6897, Parent: 6891)

sh (PID: 6897, Parent: 6891, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6898, Parent: 6897)

grep (PID: 6898, Parent: 6897, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6903, Parent: 6891)

sh (PID: 6903, Parent: 6891, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6904, Parent: 6903)

grep (PID: 6904, Parent: 6903, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6905, Parent: 1)

generate-config (PID: 6905, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6906, Parent: 6905)

pkill (PID: 6906, Parent: 6905, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6907, Parent: 1)

systemd-journald (PID: 6907, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6910, Parent: 1)

systemd-logind (PID: 6910, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6969, Parent: 1)

systemd-logind (PID: 6969, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7028, Parent: 1)

systemd-logind (PID: 7028, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7062, Parent: 1)

gpu-manager (PID: 7062, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7086, Parent: 7062)

sh (PID: 7086, Parent: 7062, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7087, Parent: 7086)

systemd New Fork (PID: 7088, Parent: 1)

generate-config (PID: 7088, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7089, Parent: 7088)

pkill (PID: 7089, Parent: 7088, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7090, Parent: 1)

systemd-journald (PID: 7090, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7093, Parent: 1)

systemd-logind (PID: 7093, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7150, Parent: 1)

dbus-daemon (PID: 7150, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7151, Parent: 1)

gpu-manager (PID: 7151, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 7152, Parent: 1)

dbus-daemon (PID: 7152, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7153, Parent: 1)

generate-config (PID: 7153, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7154, Parent: 7153)

pkill (PID: 7154, Parent: 7153, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7155, Parent: 1)

systemd-journald (PID: 7155, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7156, Parent: 1)

dbus-daemon (PID: 7156, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7161, Parent: 1)

dbus-daemon (PID: 7161, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7162, Parent: 1)

gpu-manager (PID: 7162, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7163, Parent: 7162)

sh (PID: 7163, Parent: 7162, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7164, Parent: 7163)

grep (PID: 7164, Parent: 7163, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7165, Parent: 7162)

sh (PID: 7165, Parent: 7162, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7166, Parent: 7165)

grep (PID: 7166, Parent: 7165, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7167, Parent: 1)

dbus-daemon (PID: 7167, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7168, Parent: 1)

generate-config (PID: 7168, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7169, Parent: 7168)

pkill (PID: 7169, Parent: 7168, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7170, Parent: 1)

systemd-journald (PID: 7170, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7171, Parent: 1)

gpu-manager (PID: 7171, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7172, Parent: 7171)

sh (PID: 7172, Parent: 7171, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7173, Parent: 7172)

grep (PID: 7173, Parent: 7172, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 7174, Parent: 1)

generate-config (PID: 7174, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7175, Parent: 7174)

pkill (PID: 7175, Parent: 7174, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7176, Parent: 1)

systemd-journald (PID: 7176, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7179, Parent: 1)

gpu-manager (PID: 7179, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7180, Parent: 7179)

systemd New Fork (PID: 7181, Parent: 1)

generate-config (PID: 7181, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7182, Parent: 7181)

pkill (PID: 7182, Parent: 7181, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7183, Parent: 1)

systemd-journald (PID: 7183, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7184, Parent: 1)

gpu-manager (PID: 7184, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7185, Parent: 7184)

sh (PID: 7185, Parent: 7184, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7186, Parent: 7185)

grep (PID: 7186, Parent: 7185, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7187, Parent: 7184)

sh (PID: 7187, Parent: 7184, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7188, Parent: 7187)

grep (PID: 7188, Parent: 7187, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7189, Parent: 1)

generate-config (PID: 7189, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7190, Parent: 7189)

pkill (PID: 7190, Parent: 7189, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7191, Parent: 1)

systemd-journald (PID: 7191, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7192, Parent: 1)

gpu-manager (PID: 7192, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7193, Parent: 7192)

sh (PID: 7193, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7194, Parent: 7193)

grep (PID: 7194, Parent: 7193, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7195, Parent: 7192)

sh (PID: 7195, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7196, Parent: 7195)

grep (PID: 7196, Parent: 7195, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7197, Parent: 7192)

sh (PID: 7197, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7198, Parent: 7197)

grep (PID: 7198, Parent: 7197, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7199, Parent: 7192)

sh (PID: 7199, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7200, Parent: 7199)

grep (PID: 7200, Parent: 7199, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7203, Parent: 7192)

sh (PID: 7203, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7204, Parent: 7203)

grep (PID: 7204, Parent: 7203, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7205, Parent: 7192)

sh (PID: 7205, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7206, Parent: 7205)

grep (PID: 7206, Parent: 7205, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7207, Parent: 7192)

sh (PID: 7207, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7208, Parent: 7207)

grep (PID: 7208, Parent: 7207, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7209, Parent: 7192)

sh (PID: 7209, Parent: 7192, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7210, Parent: 7209)

grep (PID: 7210, Parent: 7209, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7211, Parent: 1)

generate-config (PID: 7211, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7212, Parent: 7211)

pkill (PID: 7212, Parent: 7211, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7213, Parent: 1)

gdm-wait-for-drm (PID: 7213, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7218, Parent: 1)

gdm3 (PID: 7218, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7222, Parent: 7218)

plymouth (PID: 7222, Parent: 7218, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7295, Parent: 7218)

gdm-session-worker (PID: 7295, Parent: 7218, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7299, Parent: 7295)

gdm-wayland-session (PID: 7299, Parent: 7295, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7301, Parent: 7299)

dbus-daemon (PID: 7301, Parent: 7299, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7303, Parent: 7301)

dbus-daemon New Fork (PID: 7304, Parent: 7303)

false (PID: 7304, Parent: 7303, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7305, Parent: 7299)

dbus-run-session (PID: 7305, Parent: 7299, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7306, Parent: 7305)

dbus-daemon (PID: 7306, Parent: 7305, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7307, Parent: 7218)

Default (PID: 7307, Parent: 7218, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7308, Parent: 7218)

Default (PID: 7308, Parent: 7218, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7220, Parent: 1)

dbus-daemon (PID: 7220, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7223, Parent: 1)

systemd-logind (PID: 7223, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7280, Parent: 1)

accounts-daemon (PID: 7280, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7286, Parent: 7280)

language-validate (PID: 7286, Parent: 7280, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7287, Parent: 7286)

language-options (PID: 7287, Parent: 7286, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7288, Parent: 7287)

sh (PID: 7288, Parent: 7287, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7289, Parent: 7288)

locale (PID: 7289, Parent: 7288, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7290, Parent: 7288)

grep (PID: 7290, Parent: 7288, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7291, Parent: 1)

polkitd (PID: 7291, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7320, Parent: 1860)

dbus-daemon (PID: 7320, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7321, Parent: 1860)

pulseaudio (PID: 7321, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7322, Parent: 1)

rtkit-daemon (PID: 7322, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Y1TyhqLmmr.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x14994:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x1520b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1e868:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x11406:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x17150:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x18f7a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1ddfe:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x14dcb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x13d02:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x15096:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
Y1TyhqLmmr.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x13efb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
Y1TyhqLmmr.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x233a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
Y1TyhqLmmr.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x243d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
Y1TyhqLmmr.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x9522:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 10 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6213.1.0000000000400000.0000000000423000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f010:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f024:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f038:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f04c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f060:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f074:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f088:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f09c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f0ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f100:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f114:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f128:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f13c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f150:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f164:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f178:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f18c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f1a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x14994:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x1520b:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x1e868:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x11406:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x17150:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x18f7a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1ddfe:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x14dcb:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x13d02:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x15096:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x13efb:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x233a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x243d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6213.1.0000000000400000.0000000000423000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x9522:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: Y1TyhqLmmr.elf PID: 6213	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: Y1TyhqLmmr.elf PID: 6213	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xc67:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc7b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc8f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xca3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcb7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xccb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcdf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcf3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd07:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd1b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd2f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd43:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd57:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd6b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xda7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdbb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdcf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xde3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: Y1TyhqLmmr.elf PID: 6213	Linux_Trojan_Gafgyt_ea92cca8	unknown	unknown	0x8e5:$a: 53 65 6C 66 20 52 65 70 20 46 75 63 6B 69 6E 67 20 4E 65 54 69 53 20 61 6E 64
Click to see the 13 entries

String: AEOF/proc//proc/%s/cmdlinewgetcurlftpechokillbash/fd/proc/%s/stat/proc/proc/%d/exe/proc/%d/stat%d %s %c %d/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: global traffic	TCP traffic: 192.168.2.23:53506 -> 45.131.111.98:1312
Source: global traffic	TCP traffic: 192.168.2.23:50014 -> 89.190.156.145:7733

Source: /usr/sbin/rsyslogd (PID: 6392)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6477)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6550)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6578)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6650)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6730)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6738)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6804)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6889)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 6490)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6659)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6740)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6824)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6907)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7090)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7155)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7170)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7176)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7183)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7191)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7218)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7301)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.kovey-net.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: syslog.33.dr, syslog.53.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 37850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37850
Source: unknown	Network traffic detected: HTTP traffic on port 37648 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 37648
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: Y1TyhqLmmr.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: Y1TyhqLmmr.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6216, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6194, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6388, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6391, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6392, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6395, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6469, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6038, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6407, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6476, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6477, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6478, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6485, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6489, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6550, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6551, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6552, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6556, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6576, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6578, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6580, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6585, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6490, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6591, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6662, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6722, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6723, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6660, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6660, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6727, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6728, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6731, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6665, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6738, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6741, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6803, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6804, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6818, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6819, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6822, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6823, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6853, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6886, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6887, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6825, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6888, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6889, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6890, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6891, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6824, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6902, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6905, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7062, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6907, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7028, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7088, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7150, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7151, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7090, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7093, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7152, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7153, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7156, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7161, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7162, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7155, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7167, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7168, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7171, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7170, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7174, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7179, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7176, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7181, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7184, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7183, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7189, result: successful	Jump to behavior

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6216, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6194, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6387, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6388, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6391, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6392, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6395, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6469, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6038, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6407, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6476, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6477, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6478, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6485, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6489, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6550, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6551, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6552, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6556, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6576, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6578, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6580, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6585, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6490, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6591, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6662, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6722, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6723, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6660, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6660, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6727, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6728, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6731, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6665, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6738, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6741, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6803, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6804, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6818, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6819, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6822, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6823, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6853, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6886, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6887, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6825, result: no such process	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6888, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6889, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6890, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6891, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6824, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6902, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6905, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7062, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 6907, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7028, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7088, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7150, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7151, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7090, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7093, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7152, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7153, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7156, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7161, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7162, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7155, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7167, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7168, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7171, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7170, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7174, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7179, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7176, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7181, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7184, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7183, result: successful	Jump to behavior
Source: /tmp/Y1TyhqLmmr.elf (PID: 6215)	SIGKILL sent: pid: 7189, result: successful	Jump to behavior

Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: Y1TyhqLmmr.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: Y1TyhqLmmr.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: Y1TyhqLmmr.elf PID: 6213, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.evad.linELF@0/116@320/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6387)	File: /proc/6387/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6389)	File: /proc/6389/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6391)	File: /proc/6391/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6485)	File: /proc/6485/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6551)	File: /proc/6551/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6585)	File: /proc/6585/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6651)	File: /proc/6651/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6662)	File: /proc/6662/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6728)	File: /proc/6728/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6737)	File: /proc/6737/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6742)	File: /proc/6742/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6803)	File: /proc/6803/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6820)	File: /proc/6820/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6853)	File: /proc/6853/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6888)	File: /proc/6888/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 7150)	File: /proc/7150/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 7156)	File: /proc/7156/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 7161)	File: /proc/7161/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 7301)	File: /proc/7301/mounts
Source: /usr/bin/dbus-daemon (PID: 7306)	File: /proc/7306/mounts
Source: /usr/bin/dbus-daemon (PID: 7220)	File: /proc/7220/mounts
Source: /usr/bin/dbus-daemon (PID: 7320)	File: /proc/7320/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6216)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6216)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6221)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6407)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6407)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6407)	File: /run/systemd/seats/.#seat0V5V27F	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6493)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6493)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6493)	File: /run/systemd/seats/.#seat0nQpMX9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6591)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6591)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6591)	File: /run/systemd/seats/.#seat0MTZyny	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6665)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6665)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6665)	File: /run/systemd/seats/.#seat0U7wj4b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6745)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6745)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/seats/.#seat0Wk9Dke	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6828)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6828)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/seats/.#seat0kTOiBw	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 7093)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 7093)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 7093)	File: /run/systemd/seats/.#seat0RLLpwv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85425yUvx1V
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85426PdSY3V
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:854270Si3mY
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85428C4FhjX
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85429XWpr8Y
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85430L2l73W
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85431bWe6gZ
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85432RwjGHX
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85433KaXj2Y
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85434ugEjbX
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85435WzLfJX
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85436pqC22Y
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85437tsC8rX
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85440OWBFKU
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:854433AoXeW
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85444yUwwzY
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85445wCYp6X
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85446oyRh1U
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:854474JubmX
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85448L7XIsY
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85449d2R5oW
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85450hIqdRX
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85451yUv2vY
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85452iKEp0Y
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85453kJzAbY
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85454nIYS9V
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:854550iuI7X
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85456rgfjyW
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85457E4rIWU
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85458PuQIhV
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85459GbZ1UV
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:854606qGoqW
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:854613eM3NV
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85462H49MxW
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85463ft8O6V
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:8546404pT0W
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85465doWBYV
Source: /lib/systemd/systemd-journald (PID: 7191)	File: /run/systemd/journal/streams/.#9:85466HUPdrW
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7299)	Directory: /var/lib/gdm3/.cache
Source: /lib/systemd/systemd-logind (PID: 7223)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 7223)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 7223)	File: /run/systemd/seats/.#seat0GkNncp
Source: /lib/systemd/systemd-logind (PID: 7223)	File: /run/systemd/users/.#127FXXxyo
Source: /lib/systemd/systemd-logind (PID: 7223)	File: /run/systemd/users/.#127qJVHAo
Source: /lib/systemd/systemd-logind (PID: 7223)	File: /run/systemd/seats/.#seat0wiS5Nl
Source: /lib/systemd/systemd-logind (PID: 7223)	File: /run/systemd/users/.#127sJwKYo
Source: /lib/systemd/systemd-logind (PID: 7223)	File: /run/systemd/users/.#127RwPAKl
Source: /lib/systemd/systemd-logind (PID: 7223)	File: /run/systemd/users/.#127j82uwo
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7280)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7280)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7291)	Directory: /root/.cache

Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7220/status
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7220/attr/current
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7299/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7321/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7321/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7321/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7223/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7322/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7280/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7291/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7295/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7295/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 7220)	File opened: /proc/7218/cmdline
Source: /usr/bin/dbus-daemon (PID: 6391)	File opened: /proc/6395/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6391)	File opened: /proc/6395/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6391)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6391)	File opened: /proc/6391/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6391)	File opened: /proc/6391/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6391)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6391)	File opened: /proc/6407/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/88/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/88/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/89/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/89/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/91/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/91/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/92/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/92/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/93/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/93/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/94/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/94/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/95/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/95/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/96/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/96/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/97/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/97/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/98/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/98/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/99/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/99/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/9/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/9/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/20/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/20/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/21/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/21/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/22/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/22/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/23/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/23/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/24/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/24/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/25/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/25/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/26/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/26/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/27/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/27/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/28/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/28/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/29/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/29/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/30/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/30/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/77/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/77/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/78/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	File opened: /proc/78/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6472)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6474)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6557)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6560)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6562)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6565)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6570)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6573)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6657)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6661)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6806)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6810)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6816)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6892)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6897)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6903)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 7086)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 7163)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7165)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7172)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7185)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7187)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7193)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7195)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7197)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7199)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7203)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7205)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7207)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7209)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7288)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6473)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6475)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6558)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6561)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6563)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6566)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6571)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6574)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6658)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6724)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6807)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6814)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6817)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6893)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6898)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6904)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 7164)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7166)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7173)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7186)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7188)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7194)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7196)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7198)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7200)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7204)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7206)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7208)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7210)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7290)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6479)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6579)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6729)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6821)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6906)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 7089)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 7154)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 7169)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7175)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7182)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7190)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7212)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /lib/systemd/systemd-journald (PID: 6490)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6659)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6740)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6824)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6907)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7090)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7155)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7170)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 7176)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 7183)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 7191)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6469)	Reads version info: /etc/issue			Jump to behavior
Source: /sbin/agetty (PID: 6489)	Reads version info: /etc/issue			Jump to behavior

Source: /usr/sbin/gdm3 (PID: 7218)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7218)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7280)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7280)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6392)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6392)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6477)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6550)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6578)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6650)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6730)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6804)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6889)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7192)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/Y1TyhqLmmr.elf (PID: 6214)

File: /tmp/Y1TyhqLmmr.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6471)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6556)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6653)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6802)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6891)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 7062)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 7162)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7171)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7179)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7184)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7192)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/pkill (PID: 6479)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6579)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 7212)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7321)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6221)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6392)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6469)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6477)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6489)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6490)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6550)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6578)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6650)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6659)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6722)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6730)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6738)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6740)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6804)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6824)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6886)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6889)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6907)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7090)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7155)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7170)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7176)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7183)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7191)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7192)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7295)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7321)	Queries kernel information via 'uname':

Source: syslog.33.dr	Binary or memory string: Jun 16 10:49:53 galassia kernel: [ 417.059064] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.33.dr	Binary or memory string: Jun 16 10:49:53 galassia kernel: [ 417.059080] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 7280)

Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: Y1TyhqLmmr.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Y1TyhqLmmr.elf PID: 6213, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: Y1TyhqLmmr.elf, type: SAMPLE
Source: Yara match	File source: 6213.1.0000000000400000.0000000000423000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Y1TyhqLmmr.elf PID: 6213, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 System Owner/User Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	11 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	3 System Information Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Y1TyhqLmmr.elf	40%	Virustotal		Browse
Y1TyhqLmmr.elf	42%	ReversingLabs	Linux.Trojan.Mirai
Y1TyhqLmmr.elf	100%	Avira	EXP/ELF.Mirai.Z.A
Y1TyhqLmmr.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
daisy.ubuntu.com	0%	Virustotal		Browse
raw.kovey-net.ru	4%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://www.rsyslog.com	0%	Avira URL Cloud	safe
https://www.rsyslog.com	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	0%, Virustotal, Browse	unknown
raw.kovey-net.ru	45.131.111.98	true	false	4%, Virustotal, Browse	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.33.dr, syslog.53.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
45.131.111.98	raw.kovey-net.ru	Germany	398373	SERVERDESTROYERSUS	false
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
45.131.111.98	OkvrS38wuc.elf	Get hash	malicious	Mirai	Browse
	q5IyHlpfSQ.elf	Get hash	malicious	Mirai	Browse
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse
	eqxpPF6KKE.elf	Get hash	malicious	Mirai	Browse
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse
162.213.35.24	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	lCNMdusFkn.elf	Get hash	malicious	Unknown	Browse
	xGt89YgAK2.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	arm.pawnedbymd5hashguy.elf	Get hash	malicious	Mirai, Okiru	Browse
	zu5rawT0y9.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	jd8fmuz66T.elf	Get hash	malicious	Mirai	Browse
	VxwBBqVcmC.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	OkvrS38wuc.elf	Get hash	malicious	Mirai	Browse
	q5IyHlpfSQ.elf	Get hash	malicious	Mirai	Browse
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse
	eqxpPF6KKE.elf	Get hash	malicious	Mirai	Browse
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse
	9T95OqftPI.elf	Get hash	malicious	Unknown	Browse
109.202.202.202	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse
91.189.91.43	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse
	u8YztLuPIa.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	83LUXZfTut.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	7G2fajlBHt.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	iQYGdqlshc.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	R2OJcqnxXX.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	GaSc8GMXov.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	MyXrdY6BhI.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
raw.kovey-net.ru	q5IyHlpfSQ.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	eqxpPF6KKE.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	OkvrS38wuc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	q5IyHlpfSQ.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	eqxpPF6KKE.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	9T95OqftPI.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
CANONICAL-ASGB	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
CANONICAL-ASGB	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
SERVERDESTROYERSUS	OkvrS38wuc.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	q5IyHlpfSQ.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	eqxpPF6KKE.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	nDod2fOLjq.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	78O7BJ6Qg2.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	ZEHFQjCShK.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	haEQUvvpSG.elf	Get hash	malicious	Mirai	Browse	45.131.111.98
	7vpOTHbHoi.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	45.131.111.98
CANONICAL-ASGB	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mips.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	185.125.190.26
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
INIT7CH	qug8D8sYAW.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	f8WDIPwNGH.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	RjkHLuzLJH.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	JqhZT37T3F.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	oRABHevHfo.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	5XUL3oguJq.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	Zmc1ZshjiD.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	SecuriteInfo.com.Trojan.Linux.GenericKD.15531.25915.5506.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/proc/7304/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:kUt:kUt
MD5:	B6EAD1992C39C0F3B6A23B032B7BEC92
SHA1:	72D418EDFFB1070B9B6C1591EEC5BED3D215E2C8
SHA-256:	098BB91047A1CF40ED95E6FD1B9B88CFB502F61978781B3C323B35FEEFF72509
SHA-512:	6818E014A93BE3014B38F561F824A67A169B7199B69B62B757BCDD919476856CCDAEE5CB261906B79937A5B2A58E134B01F79BA62354FA0098D6E86E9974A6E9
Malicious:	false
Reputation:	low
Preview:	7218.

/run/systemd/journal/streams/.#9:85425yUvx1V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.535953978498358
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M0YLRcE/7TsMqji4s:qgFq6g10+f+M0YGsTMs
MD5:	40DF97417EE1B6A8615137DE647817A8
SHA1:	3ECF13A353808E7E2690A0357EA8C4EF9DD91BC6
SHA-256:	05B57B3E28AD3C1136E5B74637F160030176C731104B4AB4CB5D702F0F575E14
SHA-512:	D5A13CB13E189B554F7D116731116B5A7297018840788AF6D4A4E71B9F89E03F620861B5935FDA05E6BF9D5705B0D3E5EBBD504F36AC6EA909A38B07CCB4697B
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a61049f2498c4a96af6a97c318fe87b5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:85426PdSY3V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.458868163055821
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuEsnA5GrkFjrqjsig:SbFuFyLVIg1BG+f+MuETx2jZcHcljX+
MD5:	515DB05ED302D3D4D9F39E6F0D4B77E4
SHA1:	C55A8AFE9A8C37E9D282A3B07F62A2CD7A0D3102
SHA-256:	63E6D77418701DDC13FD547EF40702004BF5605819F0DFC7C2147B00F45410A9
SHA-512:	4AD8F3B9F077EFC4E0324DEA351B107CD68F8205172A48EB723268DE565A3466F02DACFCF753EEFBDB95F28BFDD062D795CBC3FE6995E3D8D929B8A5BB44CA62
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d5d82eb64ad1471ea5cd878e54ca9564.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:854270Si3mY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.418408546740786
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7ySQjGR7edF2js1Ha:SbFuFyLVIg1BG+f+M++R7ev2josQu
MD5:	985E9559E61C4AB1AEE1504E220566FB
SHA1:	1AFC527E71E07E3CD5E5115A725F51D0017EA549
SHA-256:	9854098E386E4B6101C936123B857D9E400415A25037ED7E4A855C75F6A1AF38
SHA-512:	E8D2A9836FBEA39F62724EE479EAE8411746E2A96973EB68435855D78A35283190FB957DEF7E44B841E45AD410E3B6E6F1A1932CB9410B77AD158D759F3C895F
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=141855994507454fa67509b99d340088.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85428C4FhjX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.349804484140413
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/SGc9nTUEXBRXDB0A:SbFuFyLVIg1BG+f+MNctxnDojdCLKzK
MD5:	9ABBE4263D7FA89D1DA42F2A85D6E733
SHA1:	58F9B3F9B097389C9AA148701D1DF8BB43C9EDF9
SHA-256:	6304602039E52CEB3F0F95C0441B1C8FCEB652F9126EA2EEE748C877DD199F20
SHA-512:	F2D8ED01A5BB409A55D16D4F53CEA18521B5056C803170B7D9BD384D4BE21A1036E6115453E907D78238AC1D23BB6E6098AC4764E75399E831251847CE84DE51
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5d6d3dc9e4ad465da2d4e8d3bbfd9caa.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85429XWpr8Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4216579268688125
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5KRHqrRmDTXsjswkT:SbFuFyLVIg1BG+f+MgRHg0YjLkGq
MD5:	4FAF8C275AE874B314A50F5FD9C28E0D
SHA1:	531933A179CF308D5D395A774B330FE9193B22F6
SHA-256:	44832463381972BD89AF48B9B97863D5167C2BF0DBC1DB4A3A2377C2E25BC36B
SHA-512:	1D85A70359537AB270C25F2F14EF6443477A02A8080493A9401F395667AC2C12FBE3CF0BAD535117A90426F47042B14C634562B3AB5C92E8D49AE1C126ED3387
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3dbe4649e8624b53b407d27b874d5fd0.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:85430L2l73W

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.444157839092343
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmp8TURdTUXk8js2ALAXA:SbFuFyLVIg1BAf+MGYROXfjNALyAZD
MD5:	672153C77C265A1997A1928C5295A32F
SHA1:	AA69CCE3EC7973F50D5DF9378F55BE1C4AEEC12C
SHA-256:	E5167309E8AFCF4B436EAECD4729CD88E388DFD35890C8F63B2E5AFCFF06E7B4
SHA-512:	7E17F75CFB40DE90D60A0C9109B91B3A2CB70E2832E4CA5EC6ED418F3AA32BC2BD1E7D6961559EF437A028848BAF6370134C4EC0BD1219177E5E221C2020A7EA
Malicious:	false
Reputation:	low
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c627086642b34cc79d3ee58f14d2aa2e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85431bWe6gZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3732688328002025
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsi09REGRCTRqjsmNm:SbFuFyLVIg1BG+f+MsiECFqjdCLKzK
MD5:	B8EFE263F3C89F527F7609D0A3F51449
SHA1:	F3766A72FE06C4C7BAE3BD3B3FEB7DAFBE30BD1D
SHA-256:	9EF180F5F2CC33C7C5DC7B841E3EC3E2CC90DBE4F1B7F4A13500D5BCD48DE09A
SHA-512:	09CCAD8A01A84477339A1DFFE3BC13E368AA7478D58F7FA03651E79CE8D049180D2690B9C564BBDF86A0B1933A8332EE85C8AFF17C0570A6752DB7F6BBCAD9B6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f748d57be20b4a8e81ea4ba645cad675.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85432RwjGHX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.42634009464232
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpYxEXFLRIrAuqjs16:SbFuFyLVIg1BG+f+MmUhuqjosQu
MD5:	5C7EA9F6528704BB034685E2E742A626
SHA1:	7252267ECA1992F454A8114AC8B2D4B4214CEA86
SHA-256:	078D01ECCA838601F1D51E1CF69B3DD4D321F58216371454030090D3086C4294
SHA-512:	1F22774433EFA12F34B9D6F4EC2FDFBDD01348AB4DD556DBCDD1F917D15CEC4E9929CBFCB4D2740C21B9EEB399941DB1BFADD56581D4D0229B9BA40380945830
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c681bd5dda734a2197967148634d973e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85433KaXj2Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.500805394987641
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M9AsDaOMqjZcHcljX+:qgFq6g10+f+M9ftmAu
MD5:	E333BBCB4B5B77D8527AD8EEA7265D93
SHA1:	0114D3AE3C031CEFACCF5B367A5A8E31C02D62CD
SHA-256:	5AF9D1321CBC032B9D138B15D86080EA298B894087A47865A2D8B31E51DF3C80
SHA-512:	6DD506E3C5A857501850494E5169B66A5F7C4BC72BB811142B8E6ECC96891B9BEC6709CA29D5C47CFC192537A41763DF3D7CF492AA21BE112321E376D57770AD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1649ce2f33344d0b8998f8982e759f33.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85434ugEjbX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.433039717579097
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm648En1WVqhZjs1Ha7:SbFuFyLVIg1BG+f+M69CA6josQu
MD5:	FD9F992864C6DD43CCDAC5F6B3A704B8
SHA1:	12A4A1BB0A3EB67DE87DB7803B7068D8EFFB3335
SHA-256:	74E23CEB51B47A8318A6DFE468D290702E68D8FD69822F58963DA40E82E293B2
SHA-512:	48A6C4A97162822B0500958C7E519F75ED278D1E1D9B4DE0974DF1D519BC0F3622419897B838237C8DEE461A37C1F6E1CB1A18F7D04847B39193918264CF0C5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0222687cf98648649a45ea9cd0c98a3d.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85435WzLfJX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.38662448226399
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrXVQkL64ryqjsmNzi:SbFuFyLVIg1BG+f+MJvrPjdCLKzK
MD5:	8AAD439F21B39A99C6D0FC90C5177A89
SHA1:	C6C0A956BF898BDCB25A98B16BB294D2B549B3B7
SHA-256:	99D30B28DB182BC1BBB3B567077DB63BAC51CE55BE72026336F1D34B30C56278
SHA-512:	0AFFDF9E762AE557762DDD428436E9A103943E66837D4E16335A6C33352E08FAB343C866CC028DF4C5084CA11F5A800642AD6A619A4374DAB0C586261A822F08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ace5b8725ed54397a6a031ddb39d6164.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85436pqC22Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4416593148195656
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzyeLT4oUmSL0js1Ha:SbFuFyLVIg1BG+f+Mee/4oUlL0josQu
MD5:	A304B662E5F065EE5F30C2E8DDA178CE
SHA1:	DDE015148881C00C126F99BC444CF5892055CF10
SHA-256:	831B3BCA3122E858ADAC760A15A65DE2D397892E5451E2715C094337F1B618A9
SHA-512:	B3C9E9C44AE38ADA20AC721B623E29EF7612F1E7C7D5302FDB04F316C7E68A48940CEC11FBB6EB5AA44F01C05DB5D17AA070FA3934408B3B25A9F5DDDA9201A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=93fa2cf1785343d2884610ffe1dd3717.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85437tsC8rX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.480776431548703
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MHksWIL5rqjZcHcljX+:qgFq6g10+f+MH/L+mAu
MD5:	318B9D4C6BC6E83B01B7650DD76DDC03
SHA1:	58994A1BDC3ED44B6F83517DAC20BB8489813420
SHA-256:	BFD1136DD596A82CA6C9CF7CF7179107525DFAABE621B42949AC54584345EC59
SHA-512:	2454502E28557C3B4D9EAEB30FECD9DAC8EFDDAE9EE7CE7AAB514DFD640A56DEA83D2D090A8D6856086A8CF2A0EE257C59094B79C98FC5DC04C2C887840AB1D4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=704992bdfc66417eb6326362ac40efd1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85440OWBFKU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3757366817520165
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu1dWczRx8wvATjdCLKzK:qgFq6g10+f+MMWEkVCLAK
MD5:	072653276435DC04371DD372D8397C24
SHA1:	1434EC8AAA99A2768973CC57C2572E15F5DEF582
SHA-256:	BF19DB6DD4767BB3FBB6D3439E4001A90F10D524B129271B7F407D2361BDC1F4
SHA-512:	2FE50FB043AA0A13D3F6224997BEBA3756DCC7CC4481A4D714A2BC4E8AD14E32FAB0FED484588C7EA30B044F0272350F6EE075CD0B4B0AFF769E79BD28FE3C41
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de67e3aedb5940418039c241b5a39fe0.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:854433AoXeW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.412287565730151
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+/lfT7HDUWR/Xsjs2Ax:SbFuFyLVIg1BAf+M+FjAjNALyAZD
MD5:	C96DB99F36691AA0373D99062EA21F36
SHA1:	E1D70B18818A80F15696AED5B5A4E87DDD227248
SHA-256:	677200BD591BD12A1D9652E32DEE5F364D04D9CCAF4CD7D9E1C706710B8DC2DD
SHA-512:	ABDBF5087C80BC5AA69FF91E884A891D1D8A9D9A57182858A084ECA9B61756AAFEAB64E9E7C930D55F60B0FBCBC8D1C7EC2E6BCCFE2C5519ECC99E7E4C10B572
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a0c21d9aabe4a20a1b5c66a7bf18142.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85444yUwwzY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.397165698423443
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6wv0cRmbOq2rxsjsc:SbFuFyLVIg1BG+f+M6wPR+OqZjosQu
MD5:	348678903A124A7143C9E808D7C33D86
SHA1:	90457A1BAD3F7C66EB34F4CA06CBBD413EEE70F4
SHA-256:	1CBABD986E5C9067276DC9AFAA5D51DA6799602D2A96810C8345B7CC93861808
SHA-512:	CA165AA8B2F68967D88DFF2E4F2812648F6A76A9999A4BD96F7B216810068D727180C8BD91DD79A9D61A0777AB0CA4E6B726FF4087BA128CC6902C1ABCFF0E7F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0e079de66a664effb612d4c3df3536e2.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85445wCYp6X

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.405139940891985
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoGRxx1cDxVSl+sjst:SbFuFyLVIg1BG+f+MoZ1clTjdCLKzK
MD5:	3978144F97F5D452009510E0E01F8924
SHA1:	26C9EA1049C218F052784B7DBBCD19C1BF9A8DBD
SHA-256:	198C6F53909CD20D588EC379AE294DFDEA5E959B89EF8333C250C6DEB178A0BC
SHA-512:	79643C6009B300B48943D7FCBE7505B44D62AA24DB45E32EED690DD74598857A280E13129DD763787479ED2A264FA2CC528B2D2F47F79D64E6D18AA911A9B5D2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bc863b12dc124547b6f9fb4070a6010a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85446oyRh1U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.35324193375436
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9BDvEtMEl0hgrqjsc:SbFuFyLVIg1BG+f+MjCl0huqjosQu
MD5:	D46C9F3E930BFDA3592E2482EDC6DDCD
SHA1:	62B860E34856CFA7DD3DB74663C0E26A2DFFDF6D
SHA-256:	DAA623206573DFDFBFA3AD7144B3F09FEDDC8518846035E3FEEF96D1F3F6971C
SHA-512:	7F482F7765AC804A2BB429939662606FE322D9710DF4BD9541BCA92DFB413A610D1D62CDFD2E894130A94B129D51575016B42348D1465041B6E2BF159BC41DA6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ebba6f37ab74aabbb50d99ea9815aee.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:854474JubmX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.366601419589083
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MHIAX56TuK5qjdCLKzK:qgFq6g10+f+MHIAXY6hCLAK
MD5:	24BE4D626774AD7D0AB03E5447513FB9
SHA1:	5D7221F9057A157FD5CC287C5B4C5D0262D8E6CB
SHA-256:	E78A5819FC1E36F2F51DB6BD30B64538D48B60B3727A891465AD5B52FDF79AAC
SHA-512:	9FEA0EE80D8C40130C33E127DC6FE1489E7FF40DBF83FA42A719F3A90C58A7DE38D596309E53217F7EBD64A60D4FB8B6BA5B572CABC4918847AC858B2F3AC8D1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=12efbef541944481b46c3a54946abb0e.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85448L7XIsY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.42754130273646
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6GVrYTE3NrhTjs1Ha:SbFuFyLVIg1BG+f+M6GF73NrZjosQu
MD5:	199562D9D378C79B1368840EFEB20D0D
SHA1:	99DF747304926C178E81EBF7BB3239819BDC2B95
SHA-256:	20DDD8EF328492053F185CA98453979037FC28FFEE3993691F0A0F7B52E8FE52
SHA-512:	2EBBE07B154220C11C01FF09DE28823C3914C9356ACF01B572C481D199619110F90FCE51E44D7CDE17DA842952A0852DA05E1253BB48E0634EAA469FF4069BEC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00036e87c9b247bfbf5b1d6a9cee23b4.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85449d2R5oW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.460248901800358
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MofOdGMVPmW0jZcHcljX+:qgFq6g10+f+MoaTgWimAu
MD5:	E597F4F1C101EEC1F0A593250D608C7F
SHA1:	92FE50C2637E84A6C34BC66EE57F27E9D0DD60B9
SHA-256:	A758BDC6D59672D6D8EC5A5E0BA69688233765F4753966A98E0AF34EE039BA86
SHA-512:	48D31195E8E98BB2D31096085A52B505B8AABEA43944C24836D2AC1F58A66089F9F2584F7F35B17C515AB3F0E74B6AC160E14E3225F07208AD3DFC9D09EA3267
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2e1ff5e4fad48c38b030da510f20943.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85450hIqdRX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.435644278598133
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp00dccNmLvsjs1Ha7:SbFuFyLVIg1BG+f+Mm0dcImL0josQu
MD5:	141395752B520F343208906F0F5A1178
SHA1:	CF5A0E482025F904E40AD02A497E0518B9D53EC0
SHA-256:	617B1FD1E06F99769DF4518A83B6715827139E74FAAB24607A59A740BFFE1291
SHA-512:	C1F5E163F833914387A6446469E7DFA64F7D9441B9A33432466A05BCBDF48C7A7EB1EF2023F69E66A91E214FA241C08F8971B97361A0FC2745858FD6343A07DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ca84d8f5bf66499f80cd43f1329bd84b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85451yUv2vY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.419983165011008
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M84qxWYEV58mjdCLKzK:qgFq6g10+f+M84E86sCLAK
MD5:	6057319CC2757296BB28C29A96B5A5C6
SHA1:	283FEF45946F1852BAD5CBAF2ED8613359CACBBB
SHA-256:	1011984F5427523D3DDEA9BB568AD3077124C934445891C2F92D716E7FA5156E
SHA-512:	2AE1A4C566F752884DB329349D98FA70E66913550DA2F85D19BCEC02AD4BBDB2365C70CF658F25E6200C8B18E993D76136DD9D9867558DD800858ABCCF7440BC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6258975b8e134722a04d06ff175cdf30.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85452iKEp0Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4074459060230735
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmv82iRRQBshALUkwsjsx:SbFuFyLVIg1BAf+M0oSALUkjNALyAZD
MD5:	8E96A74BDA4B1DA7B531BA390CB1D9FC
SHA1:	47FE1D7590C017B8BB1C5673FDDF8D5EE6226BB5
SHA-256:	66AC10678C720D0156B749B69D2086059789F05A26925224157D06FC2542D330
SHA-512:	3BA21D526E39260A74703D78183BCBA81EFE28232086F50DB32EDE0785CD47D8052D2C1EB32FA2C6D0D3787A6127B699B456B840C69E8CA28FC669F4D6C0AD5B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e862205685d144eca8d98d2e9fc602a2.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85453kJzAbY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.447144473803948
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoDETXTSnHkijosQu:qgFq6g10+f+MooBAQu
MD5:	EBEF8D2C167396F8AF69DE1152CBF697
SHA1:	0AA77DC41428EFAC017E8141029DC0AC0288FAD9
SHA-256:	33135FF531EFD9D11D1AAEBD5582B5353D3D6B21676D318EBE51163D074B57B8
SHA-512:	9FC9CAAA46D6FBADDDD2826E24700B35D6818AE35EFC40324E43984CBD6A6A1C32B97E635E29CC6C88998BF7082099AE7E1693D482EF08EF94E0A41A3B500FB7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bfa626737f6b401c8c590a20f564a904.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85454nIYS9V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.395447573435237
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8AkXBPUEBAEvsjsmM:SbFuFyLVIg1BG+f+M8JJ7BKjdCLKzK
MD5:	7AC433DD98C1DBD310979F09FA37CCE4
SHA1:	C738F90AA51F6F2453BCF71BCF0E872F5274ADBD
SHA-256:	A065602A4BBAABC2097E6E4459C8A0CF1DC37351DC4846B8A03CB34984D04C2E
SHA-512:	22908D839B9ECA215FAF1A0A3690C61936D9F8ED20562583158F45A6DC9111827C908A8FC61637AB3B233FF7623A720223348AD953E518C72A3C2B684E063073
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ebc62984da34b66980df78e35a21dea.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:854550iuI7X

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.495526942902504
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4g8RPe2jZcHcljX+:qgFq6g10+f+M78RPeYmAu
MD5:	69116AE36B2F7A3059663A279E0F3E17
SHA1:	B49CD3A5EA9E742D1CDB344393ADB00A71CAA0D0
SHA-256:	B9AAAF289BAA47927D8AC277EB03171D45022F75DE7EBCECD1F5ED51DCA13518
SHA-512:	C138AC31E3C2917ADC4AC03AA35EB84B23F97C64326C302C7A799078A89EB77929DDA9234F55D81DEB884F611B64AD9E6836060F16A8D9A7BBA5DA78DE5C474E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec5e767f3009442db7153c4610e5e8f2.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85456rgfjyW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.393518898896083
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpdE1BIHAmTjs1Had9:SbFuFyLVIg1BG+f+MDE1ojjosQu
MD5:	8C06D624C132A171FA2D4B55AD79B752
SHA1:	4FA128DD0D42D115C09523C105288673A65CAB3A
SHA-256:	97F4FB3FE3087DA02D5A59568F5E9E4497D389DD226273BF7C1C11D3AD1B925B
SHA-512:	AE47F5076A1EB95A5CD740689B4308E8674A4C30DC6B1D8E8C449835A43FD664A533CFF078863000633AB34068B252976D7A392751905DE6D2759F4D84DEB9DB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ccb70254e551467e8ab501e5beb48b95.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85457E4rIWU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.322835058782544
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvWMyWkGcQJQ25qjst:SbFuFyLVIg1BG+f+M+MTkMJ8jdCLKzK
MD5:	F20682F3AD0E2129C7FD19853D427CAA
SHA1:	C2387AB05C2C97C01585197BD183DB41A0E3E18E
SHA-256:	0FBB75C4622C73BBA4BE1F2E215D90C337EAFAE9BD8587A7A4E2F4BE4CF8FFC4
SHA-512:	C4DAA5B58ED36E2B72F749CCCBB256A8E4EE0C203FB269BE9CD62414D54AB95B442EE175CE9A9A1BBB789BED89F53A912CD42471C664152968AEF9C2F7C84114
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e348ee5e295e4edca93571a25493592d.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:85458PuQIhV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.438214660122961
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MM4yLN7RUV0MqjosQu:qgFq6g10+f+MM4yTBM4Qu
MD5:	BB3140029ED83A708DD9D4F2F84F0E8C
SHA1:	4D9D24508092571ACD05A6A313E011986961213F
SHA-256:	53C6294C083A9C83F6AE058D3E3AF75C864FF7F8BB828F1F975E7ABE8A3B60CF
SHA-512:	C3881F7E67CFEC6B07FFC0CE212B1A9A90FA93B497C144E01ACDE2EDBE8C2C3AFFCC645E89922B9066C97FEEBCF5E201CC490B48CB2D69E65B245154035C3C99
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=590a4f78796f4915bc1dc33415d39c19.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85459GbZ1UV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.362972152751758
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6tRK+Fgr8G8Df2lsS:SbFuFyLVIg1BG+f+M6tR+rC22jdCLKzK
MD5:	C9AE02541AF73C4EF1883C3BA49B6C1F
SHA1:	4F2280DC54D89CECE06D5EED9A5E828086289D21
SHA-256:	72E7A73FA47427DF011A7410CD36A7FFD19FFE47C886B4283FDBE4EA2166F53F
SHA-512:	0FD1B9139A356C5F995F5402A9CE66D603F59BF0F2CC342AF328E610936113852C484FBE409A640A0EB659E4388C1464AF8D4B7D87A0CEC2F42FA76609A208AA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=022114f3018b4c348c687ca6c1ca8f6a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:854606qGoqW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.409071812643531
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5miGJbeAqlpjs2ALAXA:SbFuFyLVIg1BAf+MArhgjNALyAZD
MD5:	4086FF11CCB31A848A2814CB9E873AC1
SHA1:	EA4CB6EE9E3E06C007F976DA84AB52A5AD513580
SHA-256:	D952730A28688271EF2CB111396D2A5141B7C530DA967C52F7A97CD0D9CFAA3E
SHA-512:	24B463989A8A997B6043FB1A552757FB393CE7B9EA997A026D33B1D8EF7C4F2BB7E8F4242C060D7FA5FC57FE2BED8BDAFE9EB95DE858441A65B13932FE4FB542
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3dc773474a3d4f0fb36be8800e142cbe.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:854613eM3NV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.518692069686412
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5UHDSdj/91c7sjsig:SbFuFyLVIg1BG+f+MvFXjZcHcljX+
MD5:	95E29D8740DE36FB3DE0A0CD5C75C421
SHA1:	F7E559EE9857667927658235FF9F69905057F4EF
SHA-256:	5AA86F2E62CD07CBDE2DA398AC585C2417A6A9DD9B9ACDEDECB8C69681D2C596
SHA-512:	4F128592064F2FA424E98133F3FC83C0372E7B55EEEDE7CCF88226BC19C44B4E39F4D7A77F4C772FBF66F4AC7488FBE75C39F119A52E76E517069551E57AF9FE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3481d6c9f78a447f80fc615bba278640.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85462H49MxW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.503605040509214
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoIcfN+/Yg2jZcHcljX+:qgFq6g10+f+MoIKNOimAu
MD5:	B77A9729DA74F89F40FD2A9E2D7B0467
SHA1:	A623E4969BC115C38EA3C737C4C2F6F06700D9F5
SHA-256:	DAFE431CDB3067DB0BC1653C8DD39B259AFF411D29A65B2C1541FBBF854FA608
SHA-512:	DD4407B5BEA4AD9CF21FF12F4BEF464414EBEC086CC1C880F18AD04843C0D5BA337CBFBBDEE3284CE96209F25D7B6AEE1191AA6BD7A35F646BF5C56AA5539D88
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b13ee4167f59463f8a293e3774c11921.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85463ft8O6V

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.470028577109612
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M0cWxnHAxsZjZcHcljX+:qgFq6g10+f+M0cWdAqzmAu
MD5:	A092794DEF057726515471808C7CC139
SHA1:	BF478122D856FB3AA52A2E235BF1EAA4265ED743
SHA-256:	A821620F1DED656F618361795D38C52A591E6E293AF1694AFFFB81EEF1B378DE
SHA-512:	3F2C5F03457B4AE636F9C62F9489695714410965737E130244719430B347827645123B12E5CBAC9E27AFA94A8FF30052AC5D23DD226EFE99666EC720C438062B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=acb882d4ba0f41539f1db1cb88b50185.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:8546404pT0W

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.402234950342673
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmubH9VCLYTjs2ALAXaGS:SbFuFyLVIg1BAf+MujzSYTjNALyAZD
MD5:	245A6DD38504A9C106519E8671D21AF3
SHA1:	3E3197D760889BF24531B756C3FA0515BD55774C
SHA-256:	C8A459940014FDDCBAD665B974ED1EA7C5910E502395DAE936A86CFDF54D4D20
SHA-512:	7A5C0CC5411E098D84B77D832975BABD225020B0583DB1DCA965FB3848CDE4D7AB24F3C26CAC5073CF8DC9801300300E16697720750956909289668EED06F072
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=df1d93b92ba14bceb933d52ef4d04cf9.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85465doWBYV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.42491054947846
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyDRGtdATjZcHcljX+:qgFq6g10+f+MiYwmAu
MD5:	D78C8CF10F8F25B98287416A767F8092
SHA1:	0451D26EFFEB9BBFA2BC1FAED04A6DF62D492AAB
SHA-256:	C10F68CCB2D2BE492A3DD9CAAC44AFF8F195D25C38738BCD10B6EA9EF5E080D9
SHA-512:	DE43A4FF368F3617A7ED2E0693786977159D4D029C7414FD3149B8AF7DFFC342B28E062170394636E7C8D270C908A5A20CD8CDD563161E0118B0C5A58C758F6E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8ce6334c39d742ad947eee415acec7ec.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85466HUPdrW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.385135625980577
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MN7GW4+RcH0ZjosQu:qgFq6g10+f+MN7BrRcH0ZQu
MD5:	210EB4228885F858763AB754A75C537A
SHA1:	7D95FC5171B3437C5D78FE0F49DB292F2F1583F6
SHA-256:	D748E52E5E80CEAD348501E15919125608D662FB8C1F003B7A09673033DA5266
SHA-512:	82CC741CFD90D7D2FCD2F6BB0C22CC689A1847733E2072F19F33D1A11C8EED836AC02FF72A6CE6F00627E3DEB001A3AE040BAD19CF879D921B7A76092FAC3493
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=75d2af09e5de49d8b303307ed67e339b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85467cZqlzV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.436720696600664
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6x7CEG7RNAg2josQu:qgFq6g10+f+MK7CHADQu
MD5:	0B5856049304E2163EDA56BEEAA73D51
SHA1:	7DDBC53A970E446393D93BDDAF8314AB38059731
SHA-256:	0A3E432B3EF7E7D4D6AB9E41A66E873B421C9921BCC0263D341A6BDFDBBF3B79
SHA-512:	AD92C074B468CA8CCEBF05DB824564AB523EC57298D263E54941C35CB277A5828A9FF9E46A0D1E5C1A3A49A4B5A688790248FBE4D615047AB16362046B740DBC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f6d288518a74bee920ac7011591460f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85468r7W1RW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.41139315089598
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+TtxEFSTBQXsjs2ALAQ:SbFuFyLVIg1BAf+M+TX1jNALyAZD
MD5:	6B51EBAE6520E97A8A1F0135156C1F25
SHA1:	E350DF42AC74C4C7F712B2F2A2CBCE0A08C89B30
SHA-256:	C51E5E5F4478297C8B657219DC75F89A53C7BC71661F2CBE84CA92F031D108DA
SHA-512:	4D1EE920829C4F211348A891159B05CAE98D1653991A9D7202B2D84D5A569C5B775C9D9C3FED7FCF0A29E21BEBE4E5B403761474CCC3117819B71D0A744E36A3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=413f1c9c842a4c41b4dcd06d7115e1a2.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85469aGz9PW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.414245923318562
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzu2fkTcy/nsjs1Ha7:SbFuFyLVIg1BG+f+MK2yvsjosQu
MD5:	B0B442E89F5E968648AEFE633CB9D6C1
SHA1:	DCBD4ED94978B9B78776ED3169B712833F5EE6A1
SHA-256:	2A8508A877DCF8F742BB6D90305095ACD9015CC7575A8C0C7F8ADD620253198F
SHA-512:	2C06BBFC151F5430F2C7F875CCD34864775FF9D4CFD540F74F5BC7BB590C80F7B853E8A9EC3807EC92BB98E16D0B156D3AA410497EC72DA64C78E028937BF3ED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91a8c454b5e04346948d2e7aa3c2451a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85470YFOiAW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.421526266515028
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyzYa5QRSR6Dqjs1Ha:SbFuFyLVIg1BG+f+My0SR9josQu
MD5:	3B403DA1118FD1B3091A9E22C669575D
SHA1:	196B4AD095B6FA5BF66F6A0EB2D061A117D7E117
SHA-256:	4094A50839DD60B5B035CA5792E087E9AF445E3CD245734A4BBFEECD59E74740
SHA-512:	0FCAC114564BC7081C8AC429670DAD9F77E1EA4C90CE5B173BEBE33EDBF025E5C428A894703509AB91326A1AA39F0B4F762DA4837B70CDDEB4FA24315EA3BF0F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=840d7647d54c4f93a8e52ea74b497a64.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85471XaPrZW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.422818085206568
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4XHdqyTHJdVQaRGrc:SbFuFyLVIg1BG+f+M4EyTHKaO0josQu
MD5:	716A441FF233C63751597DF82ED2F366
SHA1:	B2A7CA1EECF89C9CF4FD9FD41D84E7480A216169
SHA-256:	543810AE6F0D3D9EF875788E846B8BE8F2F85B39718DE6452C9B9A08B1A6BCAA
SHA-512:	F3FE9722850C7332E4B1BDE568E78D12DAA20E93BC31C99141A748C7F794677B877466D896C33833683D0164AC916E562C0276ADC486F3D52B83ABE722154259
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=280bfdaf565041b6b46f80cbfc4c2c7d.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:85472FRLsVU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.451712852845355
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmy4RTojq3Qikh+sjs2Ax:SbFuFyLVIg1BAf+My4RTkEQljNALyAZD
MD5:	0F718EA2529C75917CD6272E6DB154E3
SHA1:	41A9045D26CE1D979C4F4567EBC96014BEA64363
SHA-256:	E1924B1377A6FCD72DEDB0F97E4CA854E4BE18294DE9DDE542C5795920C411D0
SHA-512:	7DCD482CB10029F106A413D72D1590F88A491EAD95845561A29419413AEDFCCAE105CCF117EF171F17AD8C88014B430E4E0687D1BCF8E6E1291F8CAD740D2F0E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=80746c9ba9754adcb1e2f7752a97be32.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:854730VoS1Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.43133518477777
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvUXJIA982iZjs2ALAXA:SbFuFyLVIg1BAf+M8XJ99826jNALyAZD
MD5:	12C791B9A84550F0B0E5E71AAEBC6010
SHA1:	E452884483DDA5A9DF7C011B9D0E91905FF553AF
SHA-256:	36B86E0FDE0EA48E99DBAF336B88C4E2820E8B9994D66022B5153392B21E679C
SHA-512:	FE7B231F52060FF93CC34184EDEA151068B2CBCE2E7E198371A5F055E3532C43C65A2CADA03274CC526816146B81BDB84CB8FC6A563B9FC7EF5B3AE5E9E7D606
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e5d259957d0e43fc81eb13abfd23b8e7.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85474Zna09Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.451114295611675
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyYyidbbI+sjs2ALAXaN:SbFuFyLVIg1BAf+MykiTjNALyAZD
MD5:	4627E02EB67404DE02BEF4315D190F60
SHA1:	392C55C3F0A0BD117BF80FEF4C6C13AD8978A802
SHA-256:	0B9FF8D57868C77B2DB6F2A47DB2243EC2224CF6E7DD415BC44CD6F8099E7243
SHA-512:	EE2616E0A9933E75984D7ACC8FB7B5CF26E56A1319F53E03F92F974A6DA82F6653D30EF886CDB1675137DB9F494799CD5B4C6600038A28DA3B3C86A9ACC40666
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=87681f7e39844d34bd2d8fb621cf2ad3.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85475eIOWCX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.440928745671592
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6RXS59dRvF2js2ALAXA:SbFuFyLVIg1BAf+M6RK2jNALyAZD
MD5:	EDB2E671A1BCA92EC322620EF95B377E
SHA1:	0E16C80FFE17CB13EAFD656931250F2AA8D00262
SHA-256:	EAEEF02A477A7365194FC2CA918E8396D1087C82CD449388A95D94F513EDA86B
SHA-512:	046288D92BAE158EA0DB9B0AF02B2E8160EBF96AAD316C7A7D6BF2A20FF0C7BD72F15B757C8C25D7F575A09CB4F3BA4DB9DA8D4AFF1A62520E1507F0301BF2FA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=084109268d7d4e838691fae5b10bb868.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85476e7X5iY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.407432565688943
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/l+HtEwKnkzZjs2ALAQ:SbFuFyLVIg1BAf+MN+H2wKnmjNALyAZD
MD5:	97457947D9E0AFADB6644A8115CA3B12
SHA1:	31A679051B17AB891EE0026CD3E6F1FECEA46BE9
SHA-256:	8C8EC82BBD90E949F9E6483CF9D55B55E5EC5ED23FCDB281B2262CE4B307F42E
SHA-512:	B8BBABFF1D7B998BCC09137E14AC36A296D66F8BCD176A52366A4D828AB7A8E0E8AC9D366052C266BCEEE62193022FE94247AE46F22C8B7580AB5A99606CA576
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5842de515cea4aaaa125c5a56cbb8f79.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85477MeNH7U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.481091441708668
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7BQXUSrHDH+g2js2BbM:SbFuFyLVIg1BAf+MmESDqg2jNdQIeXD
MD5:	9A5E7A1BE5FE2C6F777941D3206CAFF8
SHA1:	F91A7AE4DB4728EA10FCE31280BE45F8F39C9987
SHA-256:	9EB33222041EED0B33E262A67C918190D7DCE088772C60FF1833211F8BD6DD99
SHA-512:	F01E13D7820C961368C25B06F05D6BF622DD4DD7017F4A8B6177D9E7159997F94101C263A024B04F8A9449F520BDCA7EFE723574C9DC6963BD536EB9F0BD08B0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=13c322b85b71425194cfad18f85fbd48.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:855184sFSMU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.399897122925278
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyZ/XXdXVYFp6fHNrxsH:SbFuFyLVIg1BAf+MyVXdXV8p6sjNTZD
MD5:	62D9B8E66198E3123A8306640B21312A
SHA1:	8EC2A2DF7D8A6E62E0E198F86AA857F96977734C
SHA-256:	93BCBC5645C89B4BDA801B2A8F6D58B9B45CDF25FB0B43BB9C84B1BC151B3D65
SHA-512:	EF2B09300EC858921831B41FF5801F6B7547F72BB6F91529DA2BF2EBBA7ABCACBC8838DEB5A00431D5D58AC16874E97C6247D8C96F0E489A4E79C8C079E817E3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=860d9a22820b4ee6a9d71954e22631cb.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:85523aMC4vV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.379029979161744
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsDaN9gR0qSBOmxsjx:SbFuFyLVIg1BG+f+MsDag0pBSjosQu
MD5:	4D153F3A575DC6E8FF05CE35A113B805
SHA1:	6902C281AD6749F8E07D7D6F5CB41B18A203741A
SHA-256:	5DCEEBD4C70DC4B6147F17232EEBA38AFCEED77C06BEB5D20324A44D0AE4C14E
SHA-512:	E018AA9D80D084ECCCDDC34F057F13075E0ADCCD53DDACEAE132D451ADC07678E3BB8C09360A3355F0665FFCBB0FEECDFCD1837C4E78E0895F75D1DF1BC1BF05
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fffcf4a1b504476dbe3abe57ddd1b90b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:856411xJSHW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.511670665558385
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MRlq+gGIjZcHcljX+:qgFq6g10+f+MjqT3mAu
MD5:	EF40ACD4BB3EC891AA1BB6B1C0FDDA9E
SHA1:	95B2C2A708BA535BF81CB923410713CCBAC4B87F
SHA-256:	7EF2ADF3446200AACDEBC35F35E486C5084AD1A8003ED69597332279A0736DF0
SHA-512:	9F3031C72F6F112DA6B755029F2A348F43AFBDA008390AA18501D6B4F39C65A02D41F19F424CBA95AB44745A0371EC321F39F75935BEB55E8AE09DE9AB1EEBF9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=18fcf984228449b78cddd6820a979566.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:85673MR6lHU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.439828422654191
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MbuyVbjjA5qjLTTIWTIL:qgFq6g10+f+MbRjAUEWEL
MD5:	48D362288F944F9F8E8E07F8AF1D76EE
SHA1:	2F68E72EFA645C1848CC3E0B60CA0088C7F33128
SHA-256:	2CB50129909CE9370C94679AAACB98C8592129E10A909A42A1E0F472CA7AE645
SHA-512:	80AD93197B22796C8D08EA9FC97CD52188C1D94DBC7A61C77622001AC500EE7B9C0AC48A5D3793837EDF89797E9D99B021A0FCF2952FE40E28B8C58FE900F454
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c1f13980af8140f3904ec75bf725e6ac.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:85682jieYeY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.395927309092224
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrrXcSETQaT7kNdSv9:SbFuFyLVIg1BG+f+MnxETx8SvF2jbVC
MD5:	D82A8A7F6EB2777A7FFFF206E5DAE6D0
SHA1:	83B76912958C6F5FE8E1DEA9AA702A7AA478095C
SHA-256:	E59BE28AFDF60209C823246F689914B95B818536BA5A38341C6C34A699671146
SHA-512:	394A225A203D977C709F73D0FB78AE526B4AB10A6E39C3E65CD2CCAEA48CF67F8B1F54B7E98279141F03E2D469D97A8373B562564BDEED670C0EBAC324C44732
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ad82ef0b0855465e830586ecb90f0f87.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:85701UahHyY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.403614780613055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmokAAt4VESk+bWcr:SbFuFyLVK6g7/+BG+f+MoJADb8mjNq
MD5:	B758D741F1FBE38F6C93F867A318565E
SHA1:	047AC23DE1E9324B4D800D722222612EAC3FD219
SHA-256:	05F6DB1464A7876F71F265F02E9DDBCB89E836F2B2C8CD057FC179BEEF961E6B
SHA-512:	272B3523D99297C7C9EEEA1F2BAFDBFBC571F5880300C71209A9D8A8DAC80A333D0C1D94BF8157D9DDE363E697BB82F310EDC641ABEF67292131A0064A35C705
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2b11ceebc14405487dca722a01e5437.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:85702FbN4HY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.396419911597209
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmoAcT5XZAgYRfWvr:SbFuFyLVI6g7/+BG+f+Mo3kgYR+N2jNq
MD5:	9A9264D486B56D9D15BF7F0CD0E219C6
SHA1:	80181DBCB626D3B06812F559C6F75A460F03AE87
SHA-256:	68D34451DD2ABB87C3D21D0F5029CC95D1FC58A0ADD8A3E5DD2E7A83FCBB246E
SHA-512:	8EFFB0ECD0291BEB650B460A903BF17218B1C865DB8AB4399A17A7523D4B28ACA2D7B71E1D4AF233A20C6F8EA89AA431DA22B989AE92B435DEE627731342A513
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=befe2ecc7f2a41ee98ba72ff49e95403.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:85730MUt8iV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5604893849116035
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mo97nKSDIpjFQMzKaBu:qgFqo6g7/+0+f+Molns/Tmh
MD5:	59E72D4DCAEC72B2EF769ECFC626B5A0
SHA1:	D35BF9C5F4BC1C3F1CF532036C44DAC5DC92DBC8
SHA-256:	ED9BFCC21B159F6737CCF4A2EDD522BA27BD257F1AE5AED9C71127BB4ECC3910
SHA-512:	47B1D0EC4EDB630A2342F78D01A367B64271FCF160AE93133E8EC75C0D2FCB4F07690D095DE4FDF51535D66429472BBDD6DE47B1BC01A5E2061DCCA52B704F2A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bc5525cca72d4e489871c849f7f3f6ae.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:85731cjO9gZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.542515872955331
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsUBbqjFQMzKaBu:qgFqdg7/+0+f+MsS4Tmh
MD5:	13B0B770644DFCA80CCE10975D1858A9
SHA1:	B4B95DE086DCD6D6A4F84D393CB5F5BA44F6230C
SHA-256:	49719DAA5B6FAD8A998B0EDC0652A57B425BA7B5B042006C495C52E42CE3D887
SHA-512:	EC47D1DD686108BD4F15AAB20A20DEC4B73BB1C5A7C4ABEE2A9C928ED7C6787616F9398750223761E1B4783B26FA4BE82123E0ED27DD40EF711E0337B643F989
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f833759ee9264f689d0533064ec1cf6c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:85944TVSqQV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.376468080784344
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvhVaTPcAukGgjs1Ha:SbFuFyLVIg1BG+f+M6PcnPgjoa
MD5:	4B77793A2EB87CDD4C76B3A3DEAC36C8
SHA1:	665DED483E067DE2265E59BB0C8DB7BA48347CB6
SHA-256:	CCD2390633D8DFC12D001D20D2AA49E364CD3A765398BA037737F158A673336B
SHA-512:	E8B8BA66888BE4E829142A6B8BB472A50A0CD229B98DA1678117DEA0E06631CC2D55BC01BCBB8A98697F4DA5113DF2A72C6E66631D69845064CA133DB57090F9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9502f35a1e24b0f9e12d6a765c5670f.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:85945CRZuuY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.363587535343355
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4BR1gOzXexg2jshQJ:SbFuFyLVIg1BG+f+M4n1gcem2jtWL0
MD5:	2381B1B51B45DB5B9AA41F44E5BEFDFE
SHA1:	CFC8B4E9C15B250F0E7E08E87AAE397CD61EDBAD
SHA-256:	54F32C958FA04704568878BC52C936F1DA5745423CAF92F32243F167D34DF47A
SHA-512:	149B0C0188567E0ADA4AC8E4391D74D68E21D42E8AE926CF248C8377462840A8F537E6E6066F684AE55190C33F0DF7BFA13E91918315BF9784187D3483751127
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=23c4921c32944a8a9734f3178a267dd5.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:85957Lz7uvX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.417927575928448
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8HRKRnHnvRxsjsjOA:SbFuFyLVIg1BG+f+M8HgRnHvRqjNE
MD5:	60FD917956E2BC1120DF8B146355A703
SHA1:	353F439826887EE8EEDE10DD7E78DD724C240CD4
SHA-256:	E6FFEF0F6E4C1B8E48494BA097AE568741FDC347A881D99F01DE45A29C424E9C
SHA-512:	6FFB39B9821EA3435B115B61A5ADFBDA76357F6BE2E12D35157BE5AEFE91AFA0139D7F842EFF0660D85079712DA09AE0B26E3A56C06A68FDED0DF23981312720
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6b45835a6ea3440e92919342298c599a.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/seats/.#seat0GkNncp

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0MTZyny

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0RLLpwv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0U7wj4b

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0V5V27F

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Wk9Dke

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0kTOiBw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0nQpMX9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0wiS5Nl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#127FXXxyo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127RwPAKl

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.318065319717911
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJg3QJe/V5x4WvKW6H206qodjdR4:SbFuFyL3BVgdL87iesnAiRJg3QJOVjLo
MD5:	D3497EFDA15F7FC1EA516086884B6605
SHA1:	63C36823572DF51D166756473DD9B4805B64D196
SHA-256:	2AEF50E67F513BC46C1C2B71F4FBA25BC45F0FF251D03DEF8B07026DFEA14761
SHA-512:	CBFEAE06BC65CAE9FB6C4659477055140C8BE78A2B074E3960B6C5C8D403574EC1BC3A3F830A595E086D6E36196A9A9FE83B318F468B865764E8292CCAF845FF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1718553059647000.MONOTONIC=483804073.LAST_SESSION_TIMESTAMP=483868410.

/run/systemd/users/.#127j82uwo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.477605044430744
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff1SRJg3QJOVjLWt6FdR4:qgFq30dABibBgRJg3Q8VuInR4
MD5:	CBECEC8EC5D7578D536E8184CBC633B1
SHA1:	66DDD491042A66F59F453C5C5B3D3E68A63CC56B
SHA-256:	F425FFAEAA2D0DB25BBCD01BD27A42792429C29420A5C10EAE25671057458BF5
SHA-512:	65FB6941AB0E6C0962898BC9BB2AA167E41C5E1D15AC6C8B1E57137DA1A79775CC3DBB9695A91688F3A8D7950249BE596A6F658BA6354612FABEB56C24B958DB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/17287.REALTIME=1718553059647000.MONOTONIC=483804073.LAST_SESSION_TIMESTAMP=483868410.

/run/systemd/users/.#127qJVHAo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30389792818665
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff/Qv5Jg3QJOVjLqQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBnQv5Jg3Q8VcthQHtM
MD5:	F83AE34BA37C0B7D80A80774820FC117
SHA1:	5C3213FAEFFDCC3AC4F92E8619947AC5397827B7
SHA-256:	047A31224A5D67D9C7A4C777F1F161F987DEA98B1EBCCFD116E816B4A6DE3866
SHA-512:	D998DC46C6A369D65F332D3A74D75DEB3F27C412A3CCB7BF2EDDE135A46AE396623D46A57390212C181A206368A75C47CECE50E67277BF3DF845D80BD7818769
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/17225.REALTIME=1718553059647000.MONOTONIC=483804073.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sJwKYo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30389792818665
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff/Qv5Jg3QJOVjLqQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBnQv5Jg3Q8VcthQHtM
MD5:	F83AE34BA37C0B7D80A80774820FC117
SHA1:	5C3213FAEFFDCC3AC4F92E8619947AC5397827B7
SHA-256:	047A31224A5D67D9C7A4C777F1F161F987DEA98B1EBCCFD116E816B4A6DE3866
SHA-512:	D998DC46C6A369D65F332D3A74D75DEB3F27C412A3CCB7BF2EDDE135A46AE396623D46A57390212C181A206368A75C47CECE50E67277BF3DF845D80BD7818769
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/17225.REALTIME=1718553059647000.MONOTONIC=483804073.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:lG:4
MD5:	EC0034C2EA9B8ABFCF4B7AAF0A1BA0B7
SHA1:	739DB18BB5CF8AA86ABEB417DF6B450C98B4FFF1
SHA-256:	ADAFF51B0B10C945C4593FA22AA550E019571045B0E693FA64B270D66EAB0905
SHA-512:	254B28E257F1DC94BD0EECCBE98C97E7A40DDEDD38413F96D847615846D57C40C83FC168ADE4F23E37B435CBC3048919D7F64B90C7FA06ECE6A52F18E2740A9F
Malicious:	false
Preview:	7321.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:Z0sXlXEWtl/xQXw:ZV+ylJ
MD5:	282F80F171A5327E8C98E9508DE2489F
SHA1:	E0B7E954CAF7D5269919DA2510F3033717DB7DED
SHA-256:	0CD78B4A72D18D433330EA343AA2300D2C044587EE81C85083033D5AA80220B8
SHA-512:	408DC1D45BE1116CE586C6330BBF4DC30BD740A33B6AE922227686C78C9372A69A4D8838E7D8A89E2057ADBAAF6F82C8FD8F7519AEAC3C0580B4F859EB7ED9D3
Malicious:	false
Preview:	....Y...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................Y.....of........................................

/var/lib/AccountsService/users/gdm.HLZVO2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	982
Entropy (8bit):	4.896993840256452
Encrypted:	false
SSDEEP:	24:aNZerNZ4wj/n2n+I5h/Avu/A2+VcthAqx:hvBfViXx
MD5:	957E6B3A68C4620D38A759BA8692D3FE
SHA1:	A4FAEDB3A66D167D920B3B00D3D5F3EEF8BDE817
SHA-256:	1B3014445CCD71F29690FE4CCBCAD742FAF2464A696BA063ABB1AE8508656A78
SHA-512:	CD9C3216C4A647FC3963BC707B9840E7526D524D942B0BE8F86AFA55AD153C0BE0D3AF20C8E1FBE05137829FFEE37C6324287A2A122B3CADF58CC6EF8B9A865B
Malicious:	false
Preview:	Jun 16 10:49:55 galassia systemd-logind[6407]: Failed to add user by file name 1000, ignoring: Invalid argument.Jun 16 10:49:55 galassia systemd-logind[6407]: Failed to add user by file name 127, ignoring: Invalid argument.Jun 16 10:49:55 galassia systemd-logind[6407]: User enumeration failed: Invalid argument.Jun 16 10:49:55 galassia systemd-logind[6407]: User of session 2 not known..Jun 16 10:49:55 galassia systemd-logind[6407]: User of session c1 not known..Jun 16 10:49:55 galassia systemd-logind[6407]: Session enumeration failed: No such file or directory.Jun 16 10:49:56 galassia systemd-logind[6407]: Watching system buttons on /dev/input/event0 (Power Button).Jun 16 10:49:56 galassia systemd-logind[6407]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Jun 16 10:49:56 galassia systemd-logind[6407]: New seat seat0..Jun 16 10:49:56 galassia gdm-password]: pam_systemd(gdm-password:session): Failed to release session: No session '2' known.

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.3807197082782183
Encrypted:	false
SSDEEP:	3:F31Hl55Fp7mdy//p5Fp7mdyV:F33FpqdCfFpqdG
MD5:	1DE87297E5C1EBD6CC382BD595327733
SHA1:	2A1CE0ED6C8EF34EE17651D140AC9BAE8F0F6DDF
SHA-256:	C03230C319D2C66B1E8E36455F9C4AC7D7BC6315CE0B7C4DA9557935DCF6FDEF
SHA-512:	6AEC3F2F2A5996E384860AA4F6447CA3193420F118D516EFD17DA985B0581FBBF4C32DAD094B142056000115770D02852D655D09041EFCB639E7CD407E33D160
Malicious:	false
Preview:	LPKSHHRH................m...@.L...N..b.................................m...@.L...N..b.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4026448342238123
Encrypted:	false
SSDEEP:	3:F31Hl2Ig7IGIg74/:F3mj7IGj74
MD5:	5A712EA5D1E692646B27DB35F6F2C769
SHA1:	D4FAF7A035FF3F4AF1910792B222940BF15C8332
SHA-256:	CE44ADAD223048228B462A7FBACFF851A425D09F7416EABEC1EBABDBD31D7886
SHA-512:	6FF43C3E63B0C1D1047F290F6A83B5E4D196D91B1DD06F6B39B34B8089E119AF59C2AF8B904185BB10B5078E98C30A19990F261439ABA031E5C3418580B75178
Malicious:	false
Preview:	LPKSHHRH................He`..,K...H.:G..................................He`..,K...H.:G..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	8331
Entropy (8bit):	4.723557784294949
Encrypted:	false
SSDEEP:	192:BYC01/3O1DzfFG/73uRuQKdfDW0hfm5wXAfNUAQd51VI2nrwEuy8l3VyZ2vPFZrI:tqCHvNini/FyNCYm/nP68DplAwIJspxc
MD5:	406A0F611FDA2706D3ADE409DA5C2EBF
SHA1:	ED391794F4D61F3F256EFC2B6E87C383501AA08D
SHA-256:	3731A3E7746A2E1679BE516F071642770B4C9161095A3ACF2F86458A59AB57E4
SHA-512:	5D0FCA0F2816D4210602A4D083FBBA91E01C3C7522724DDB1F748D4852FEA646CBA15C1A9375F7004930671AC37690D58EB01CC9F9715C3EF34C89399C7C98B0
Malicious:	false
Preview:	Jun 16 10:50:24 galassia kernel: [ 446.393607] New task spawned: old: (tgid 6819, tid 6819), new (tgid: 6821, tid: 6821).Jun 16 10:50:24 galassia kernel: [ 446.569565] blocking signal 19: 6215 -> 720.Jun 16 10:50:24 galassia kernel: [ 446.579656] blocking signal 19: 6215 -> 759.Jun 16 10:50:24 galassia kernel: [ 446.588827] blocking signal 19: 6215 -> 761.Jun 16 10:50:24 galassia kernel: [ 446.597544] blocking signal 19: 6215 -> 772.Jun 16 10:50:24 galassia kernel: [ 446.613060] blocking signal 19: 6215 -> 936.Jun 16 10:50:24 galassia kernel: [ 446.637724] blocking signal 19: 6215 -> 1334.Jun 16 10:50:24 galassia kernel: [ 446.648407] blocking signal 19: 6215 -> 1335.Jun 16 10:50:24 galassia kernel: [ 446.659071] blocking signal 19: 6215 -> 1860.Jun 16 10:50:24 galassia kernel: [ 446.670778] blocking signal 19: 6215 -> 1872.Jun 16 10:50:24 galassia kernel: [ 446.680570] blocking signal 19: 6215 -> 2048.Jun 16 10:50:24 galassia kernel: [ 446.769040] blocking signal 9: 6215 -

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	16729
Entropy (8bit):	4.98453982892051
Encrypted:	false
SSDEEP:	384:cqgsjuSI7LVTrvNini/FyNCYm/nP68DplAwIJspxsY:cqgJdvNini/FyNCYm/nP68DplAwIJspb
MD5:	83C3178F4E78A5EB51B5F570A0F9F97F
SHA1:	156A32EF0325439761C8CBA97061ABA1C8BCFD68
SHA-256:	21020073ED6944008DF7E18A3421C3D8385FDFCD2BE907E0A26617F762AD22D3
SHA-512:	7902D30402239CF354F9E529BB62900F10C6B44727B569A295A02A833266C6563180452A4830EBD70AAEB9DE9844174124B0BAE1D503FB0BFF2CC0F7C85C7F3B
Malicious:	false
Preview:	Jun 16 10:50:24 galassia kernel: [ 446.281751] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Jun 16 10:50:24 galassia kernel: [ 446.281815] systemd[1]: rsyslog.service: Failed with result 'signal'..Jun 16 10:50:24 galassia kernel: [ 446.302179] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Jun 16 10:50:24 galassia kernel: [ 446.302249] systemd[1]: whoopsie.service: Failed with result 'signal'..Jun 16 10:50:24 galassia kernel: [ 446.302679] systemd-journald[6740]: File /var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal corrupted or uncleanly shut down, renaming and replacing..Jun 16 10:50:24 galassia kernel: [ 446.393607] New task spawned: old: (tgid 6819, tid 6819), new (tgid: 6821, tid: 6821).Jun 16 10:50:24 galassia kernel: [ 446.405281] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 10..Jun 16 10:50:24 galassia kernel: [ 446.405349] systemd[1]: whoopsie.service: Scheduled

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:Z0sXlXEWtl/xQXw:ZV+ylJ
MD5:	282F80F171A5327E8C98E9508DE2489F
SHA1:	E0B7E954CAF7D5269919DA2510F3033717DB7DED
SHA-256:	0CD78B4A72D18D433330EA343AA2300D2C044587EE81C85083033D5AA80220B8
SHA-512:	408DC1D45BE1116CE586C6330BBF4DC30BD740A33B6AE922227686C78C9372A69A4D8838E7D8A89E2057ADBAAF6F82C8FD8F7519AEAC3C0580B4F859EB7ED9D3
Malicious:	true
Preview:	....Y...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................Y.....of........................................

Source: Y1TyhqLmmr.elf	Virustotal: Detection: 40%			Perma Link
Source: Y1TyhqLmmr.elf	ReversingLabs: Detection: 42%

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.485666878207938
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	Y1TyhqLmmr.elf
File size:	178'376 bytes
MD5:	fa8c6f9157f9748e80a8c76167f5a673
SHA1:	ddf24385e36214be0337b27f8e5a80bf910413a6
SHA256:	412dde5b06d7bd1c11f90045fc823818a690c87b044c1aa3a86e1a3fe8150f98
SHA512:	d3885106f47f5b0dd35a64e1d644631ee27ba280dcc37ef1ffca7fe72b470d9d0d38b62e6a7754640dee09193edfc92f2991b011cd6176a114e871562d590ae6
SSDEEP:	3072:MpLxw0D8KTrAdfve0nHVppLUf5BoBgoL0qaeSF5esGokCZ8bl3C0UKERBm:MpLxw0D8KTrAdfve0nHfJUfnw43ZkeR8
TLSH:	E1044B17B5C184FDC49AC1744BAFF53AE971F19D123CB26B27C4AA222E4DE205F2D990
File Content Preview:	.ELF..............>.......@.....@.......H...........@.8...@.......................@.......@......'.......'.......................'.......'R......'R..... .......................Q.td....................................................H...._....z...H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	177736
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x1e4a6	0x0	0x6	AX	16
.fini	PROGBITS	0x41e5a6	0x1e5a6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x41e5c0	0x1e5c0	0x4220	0x0	0x2	A	32
.ctors	PROGBITS	0x5227e8	0x227e8	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x522800	0x22800	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x522820	0x22820	0x8de8	0x0	0x3	WA	32
.bss	NOBITS	0x52b620	0x2b608	0x72e0	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x2b608	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x227e0	0x227e0	6.3777	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x227e8	0x5227e8	0x5227e8	0x8e20	0x10118	0.2383	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jun 16, 2024 17:49:58.924216986 CEST	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Jun 16, 2024 17:51:18.945417881 CEST	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Start time (UTC):	15:49:51
Start date (UTC):	16/06/2024
Path:	/tmp/Y1TyhqLmmr.elf
Arguments:	/tmp/Y1TyhqLmmr.elf
File size:	178376 bytes
MD5 hash:	fa8c6f9157f9748e80a8c76167f5a673

Start time (UTC):	15:49:52
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:49:53
Start date (UTC):	16/06/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	15:49:54
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:49:56
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:49:57
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:49:58
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:50:00
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:01
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:06
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:02
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:03
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:04
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:50:05
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report Y1TyhqLmmr.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/proc/7304/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:85425yUvx1V

/run/systemd/journal/streams/.#9:85426PdSY3V

/run/systemd/journal/streams/.#9:854270Si3mY

/run/systemd/journal/streams/.#9:85428C4FhjX

/run/systemd/journal/streams/.#9:85429XWpr8Y

/run/systemd/journal/streams/.#9:85430L2l73W

/run/systemd/journal/streams/.#9:85431bWe6gZ

/run/systemd/journal/streams/.#9:85432RwjGHX

/run/systemd/journal/streams/.#9:85433KaXj2Y

/run/systemd/journal/streams/.#9:85434ugEjbX

/run/systemd/journal/streams/.#9:85435WzLfJX

/run/systemd/journal/streams/.#9:85436pqC22Y

/run/systemd/journal/streams/.#9:85437tsC8rX

/run/systemd/journal/streams/.#9:85440OWBFKU

/run/systemd/journal/streams/.#9:854433AoXeW

/run/systemd/journal/streams/.#9:85444yUwwzY

/run/systemd/journal/streams/.#9:85445wCYp6X

/run/systemd/journal/streams/.#9:85446oyRh1U

/run/systemd/journal/streams/.#9:854474JubmX

/run/systemd/journal/streams/.#9:85448L7XIsY

/run/systemd/journal/streams/.#9:85449d2R5oW

/run/systemd/journal/streams/.#9:85450hIqdRX

Linux Analysis Report
Y1TyhqLmmr.elf

Start time (UTC):	15:50:07
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:08
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:12
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:13
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:14
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:15
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	15:50:16
Start date (UTC):	16/06/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	15:50:18
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:19
Start date (UTC):	16/06/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	15:50:20
Start date (UTC):	16/06/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761