Edit tour

Linux Analysis Report
byte.arm.elf

Overview

General Information

Sample name:	byte.arm.elf
Analysis ID:	1540133
MD5:	a59ec8a40225153c5e227ddb42c2026e
SHA1:	51733d2e5fb47114c06659978ca28954136a7e30
SHA256:	e8d88c892972d0f61f915bbc8581d83a14ef86c6495d8406dba94adaeee96f19
Tags:	elfuser-abuse_ch
Infos:

Detection

Okiru

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Okiru

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540133
Start date and time:	2024-10-23 13:33:54 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 31s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	byte.arm.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/1053@1/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: byte.arm.elf

Process Tree

system is lnxubuntu20

byte.arm.elf (PID: 5505, Parent: 5428, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/byte.arm.elf

byte.arm.elf New Fork (PID: 5507, Parent: 5505)

byte.arm.elf New Fork (PID: 5508, Parent: 5505)

byte.arm.elf New Fork (PID: 5511, Parent: 5505)

byte.arm.elf New Fork (PID: 5513, Parent: 5511)

byte.arm.elf New Fork (PID: 5519, Parent: 5511)

byte.arm.elf New Fork (PID: 5521, Parent: 5511)

byte.arm.elf New Fork (PID: 5522, Parent: 5511)

byte.arm.elf New Fork (PID: 5525, Parent: 5511)

systemd New Fork (PID: 5528, Parent: 1)

journalctl (PID: 5528, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5549, Parent: 1)

dbus-daemon (PID: 5549, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 5558, Parent: 1289)

Default (PID: 5558, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5561, Parent: 1)

rsyslogd (PID: 5561, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 5562, Parent: 1289)

Default (PID: 5562, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5563, Parent: 2955)

pulseaudio (PID: 5563, Parent: 2955, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 5564, Parent: 3147)

fusermount (PID: 5564, Parent: 3147, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

gdm3 New Fork (PID: 5565, Parent: 1289)

Default (PID: 5565, Parent: 1289, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5568, Parent: 1)

systemd-journald (PID: 5568, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5569, Parent: 1)

dbus-daemon (PID: 5569, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5573, Parent: 1)

systemd-journald (PID: 5573, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5574, Parent: 1)

dbus-daemon (PID: 5574, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5575, Parent: 1)

rsyslogd (PID: 5575, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5583, Parent: 1)

systemd-logind (PID: 5583, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5640, Parent: 1)

systemd-journald (PID: 5640, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5641, Parent: 1)

rsyslogd (PID: 5641, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5644, Parent: 1)

systemd-logind (PID: 5644, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5701, Parent: 1)

gpu-manager (PID: 5701, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5702, Parent: 5701)

sh (PID: 5702, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5703, Parent: 5702)

grep (PID: 5703, Parent: 5702, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5704, Parent: 5701)

sh (PID: 5704, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5708, Parent: 5704)

grep (PID: 5708, Parent: 5704, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5712, Parent: 5701)

sh (PID: 5712, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5713, Parent: 5712)

grep (PID: 5713, Parent: 5712, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5714, Parent: 5701)

sh (PID: 5714, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5715, Parent: 5714)

grep (PID: 5715, Parent: 5714, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5716, Parent: 5701)

sh (PID: 5716, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5717, Parent: 5716)

grep (PID: 5717, Parent: 5716, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5718, Parent: 5701)

sh (PID: 5718, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5719, Parent: 5718)

grep (PID: 5719, Parent: 5718, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5720, Parent: 5701)

sh (PID: 5720, Parent: 5701, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5721, Parent: 5720)

systemd New Fork (PID: 5709, Parent: 1)

dbus-daemon (PID: 5709, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5722, Parent: 1)

generate-config (PID: 5722, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5724, Parent: 5722)

pkill (PID: 5724, Parent: 5722, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5723, Parent: 1)

dbus-daemon (PID: 5723, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5725, Parent: 1)

systemd-journald (PID: 5725, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5726, Parent: 1)

rsyslogd (PID: 5726, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5729, Parent: 1)

systemd-logind (PID: 5729, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5789, Parent: 1)

gpu-manager (PID: 5789, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5791, Parent: 5789)

sh (PID: 5791, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5792, Parent: 5791)

grep (PID: 5792, Parent: 5791, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5793, Parent: 5789)

sh (PID: 5793, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5794, Parent: 5793)

grep (PID: 5794, Parent: 5793, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5797, Parent: 5789)

sh (PID: 5797, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5798, Parent: 5797)

grep (PID: 5798, Parent: 5797, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5799, Parent: 5789)

sh (PID: 5799, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5800, Parent: 5799)

grep (PID: 5800, Parent: 5799, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5801, Parent: 5789)

sh (PID: 5801, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5802, Parent: 5801)

grep (PID: 5802, Parent: 5801, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5803, Parent: 5789)

sh (PID: 5803, Parent: 5789, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5804, Parent: 5803)

grep (PID: 5804, Parent: 5803, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5790, Parent: 1)

dbus-daemon (PID: 5790, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5806, Parent: 1)

generate-config (PID: 5806, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5807, Parent: 5806)

pkill (PID: 5807, Parent: 5806, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5808, Parent: 1)

systemd-journald (PID: 5808, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5809, Parent: 1)

rsyslogd (PID: 5809, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5813, Parent: 1)

systemd-logind (PID: 5813, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5873, Parent: 1)

dbus-daemon (PID: 5873, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5874, Parent: 1)

gpu-manager (PID: 5874, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5875, Parent: 5874)

sh (PID: 5875, Parent: 5874, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5876, Parent: 5875)

grep (PID: 5876, Parent: 5875, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5877, Parent: 5874)

sh (PID: 5877, Parent: 5874, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5878, Parent: 5877)

grep (PID: 5878, Parent: 5877, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5879, Parent: 5874)

sh (PID: 5879, Parent: 5874, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5880, Parent: 5879)

grep (PID: 5880, Parent: 5879, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5883, Parent: 5874)

sh (PID: 5883, Parent: 5874, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5884, Parent: 5883)

grep (PID: 5884, Parent: 5883, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5885, Parent: 5874)

sh (PID: 5885, Parent: 5874, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5886, Parent: 5885)

grep (PID: 5886, Parent: 5885, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5887, Parent: 5874)

sh (PID: 5887, Parent: 5874, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5888, Parent: 5887)

grep (PID: 5888, Parent: 5887, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5889, Parent: 1)

generate-config (PID: 5889, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5891, Parent: 5889)

pkill (PID: 5891, Parent: 5889, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5890, Parent: 1)

dbus-daemon (PID: 5890, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5892, Parent: 1)

rsyslogd (PID: 5892, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5893, Parent: 1)

systemd-journald (PID: 5893, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5895, Parent: 1)

dbus-daemon (PID: 5895, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5898, Parent: 1)

systemd-logind (PID: 5898, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5955, Parent: 1)

gpu-manager (PID: 5955, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5959, Parent: 5955)

sh (PID: 5959, Parent: 5955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5960, Parent: 5959)

grep (PID: 5960, Parent: 5959, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5961, Parent: 5955)

sh (PID: 5961, Parent: 5955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5962, Parent: 5961)

grep (PID: 5962, Parent: 5961, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5963, Parent: 5955)

sh (PID: 5963, Parent: 5955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5964, Parent: 5963)

grep (PID: 5964, Parent: 5963, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5965, Parent: 5955)

sh (PID: 5965, Parent: 5955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5966, Parent: 5965)

grep (PID: 5966, Parent: 5965, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5967, Parent: 5955)

sh (PID: 5967, Parent: 5955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5968, Parent: 5967)

grep (PID: 5968, Parent: 5967, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5971, Parent: 5955)

sh (PID: 5971, Parent: 5955, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5972, Parent: 5971)

grep (PID: 5972, Parent: 5971, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5973, Parent: 1)

generate-config (PID: 5973, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5975, Parent: 5973)

pkill (PID: 5975, Parent: 5973, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5974, Parent: 1)

rsyslogd (PID: 5974, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5976, Parent: 1)

systemd-journald (PID: 5976, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5980, Parent: 1)

systemd-logind (PID: 5980, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6028, Parent: 1)

rsyslogd (PID: 6028, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6038, Parent: 1)

gpu-manager (PID: 6038, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6042, Parent: 6038)

sh (PID: 6042, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6043, Parent: 6042)

grep (PID: 6043, Parent: 6042, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6045, Parent: 6038)

sh (PID: 6045, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6046, Parent: 6045)

grep (PID: 6046, Parent: 6045, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6047, Parent: 6038)

sh (PID: 6047, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6048, Parent: 6047)

grep (PID: 6048, Parent: 6047, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6049, Parent: 6038)

sh (PID: 6049, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6050, Parent: 6049)

grep (PID: 6050, Parent: 6049, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6051, Parent: 6038)

sh (PID: 6051, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6052, Parent: 6051)

grep (PID: 6052, Parent: 6051, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6053, Parent: 6038)

sh (PID: 6053, Parent: 6038, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6054, Parent: 6053)

grep (PID: 6054, Parent: 6053, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6044, Parent: 1)

dbus-daemon (PID: 6044, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6057, Parent: 1)

generate-config (PID: 6057, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6060, Parent: 6057)

pkill (PID: 6060, Parent: 6057, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6058, Parent: 1)

dbus-daemon (PID: 6058, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6059, Parent: 1)

rsyslogd (PID: 6059, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6061, Parent: 1)

systemd-journald (PID: 6061, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6063, Parent: 1)

dbus-daemon (PID: 6063, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6066, Parent: 1)

systemd-logind (PID: 6066, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6123, Parent: 1)

rsyslogd (PID: 6123, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6127, Parent: 1)

gpu-manager (PID: 6127, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6128, Parent: 6127)

sh (PID: 6128, Parent: 6127, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6129, Parent: 6128)

grep (PID: 6129, Parent: 6128, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6130, Parent: 6127)

sh (PID: 6130, Parent: 6127, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6131, Parent: 6130)

grep (PID: 6131, Parent: 6130, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6132, Parent: 6127)

sh (PID: 6132, Parent: 6127, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6133, Parent: 6132)

grep (PID: 6133, Parent: 6132, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6134, Parent: 6127)

sh (PID: 6134, Parent: 6127, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6135, Parent: 6134)

grep (PID: 6135, Parent: 6134, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6136, Parent: 1)

dbus-daemon (PID: 6136, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6137, Parent: 1)

generate-config (PID: 6137, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6138, Parent: 6137)

pkill (PID: 6138, Parent: 6137, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6139, Parent: 1)

systemd-journald (PID: 6139, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6140, Parent: 1)

rsyslogd (PID: 6140, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6142, Parent: 1)

dbus-daemon (PID: 6142, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6145, Parent: 1)

systemd-logind (PID: 6145, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6202, Parent: 1)

gpu-manager (PID: 6202, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6205, Parent: 6202)

sh (PID: 6205, Parent: 6202, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6206, Parent: 6205)

grep (PID: 6206, Parent: 6205, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6210, Parent: 6202)

sh (PID: 6210, Parent: 6202, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

systemd New Fork (PID: 6211, Parent: 1)

generate-config (PID: 6211, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6212, Parent: 6211)

pkill (PID: 6212, Parent: 6211, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6213, Parent: 1)

systemd-journald (PID: 6213, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6214, Parent: 1)

rsyslogd (PID: 6214, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6218, Parent: 1)

systemd-logind (PID: 6218, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6276, Parent: 1)

systemd-journald (PID: 6276, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6332, Parent: 1)

systemd-journald (PID: 6332, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6408, Parent: 1)

gpu-manager (PID: 6408, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6409, Parent: 1)

generate-config (PID: 6409, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6410, Parent: 6409)

pkill (PID: 6410, Parent: 6409, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6411, Parent: 1)

gpu-manager (PID: 6411, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6412, Parent: 1)

generate-config (PID: 6412, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6413, Parent: 1)

gpu-manager (PID: 6413, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6414, Parent: 1)

generate-config (PID: 6414, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6417, Parent: 1)

gpu-manager (PID: 6417, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6418, Parent: 1)

generate-config (PID: 6418, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6419, Parent: 1)

plymouth (PID: 6419, Parent: 1, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: /bin/plymouth quit

systemd New Fork (PID: 6421, Parent: 2955)

dbus-daemon (PID: 6421, Parent: 2955, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
byte.arm.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security

Memory Dumps

Source	Rule	Description	Author
5519.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5507.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5505.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5508.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5522.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5525.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5511.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5521.1.00007f89c8017000.00007f89c802b000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5505	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5507	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5508	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5511	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5519	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5521	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5522	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.arm.elf PID: 5525	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 11 entries

String: byte/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAmnesi

Source: /usr/bin/pkill (PID: 5807)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5891)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5975)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5575)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5641)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5726)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5809)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5892)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6028)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6123)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6140)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 5573)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5640)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5725)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5808)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5893)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5976)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6061)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6139)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 53.140.20.26
Source: unknown	TCP traffic detected without corresponding DNS query: 77.4.136.31
Source: unknown	TCP traffic detected without corresponding DNS query: 82.214.28.31
Source: unknown	TCP traffic detected without corresponding DNS query: 102.181.79.206
Source: unknown	TCP traffic detected without corresponding DNS query: 179.181.54.159
Source: unknown	TCP traffic detected without corresponding DNS query: 18.252.222.63
Source: unknown	TCP traffic detected without corresponding DNS query: 152.174.26.251
Source: unknown	TCP traffic detected without corresponding DNS query: 207.69.235.117
Source: unknown	TCP traffic detected without corresponding DNS query: 128.161.27.208
Source: unknown	TCP traffic detected without corresponding DNS query: 185.81.59.135
Source: unknown	TCP traffic detected without corresponding DNS query: 81.117.255.168
Source: unknown	TCP traffic detected without corresponding DNS query: 34.219.63.57
Source: unknown	TCP traffic detected without corresponding DNS query: 204.192.255.226
Source: unknown	TCP traffic detected without corresponding DNS query: 189.117.83.225
Source: unknown	TCP traffic detected without corresponding DNS query: 81.75.87.84
Source: unknown	TCP traffic detected without corresponding DNS query: 124.36.187.69
Source: unknown	TCP traffic detected without corresponding DNS query: 159.35.244.30
Source: unknown	TCP traffic detected without corresponding DNS query: 82.13.175.140
Source: unknown	TCP traffic detected without corresponding DNS query: 64.133.194.158
Source: unknown	TCP traffic detected without corresponding DNS query: 140.140.201.167
Source: unknown	TCP traffic detected without corresponding DNS query: 35.97.206.194
Source: unknown	TCP traffic detected without corresponding DNS query: 83.49.131.27
Source: unknown	TCP traffic detected without corresponding DNS query: 100.55.60.101
Source: unknown	TCP traffic detected without corresponding DNS query: 100.142.203.50
Source: unknown	TCP traffic detected without corresponding DNS query: 97.93.163.191
Source: unknown	TCP traffic detected without corresponding DNS query: 132.33.247.187
Source: unknown	TCP traffic detected without corresponding DNS query: 153.124.73.224
Source: unknown	TCP traffic detected without corresponding DNS query: 136.111.106.120
Source: unknown	TCP traffic detected without corresponding DNS query: 77.2.65.83
Source: unknown	TCP traffic detected without corresponding DNS query: 104.240.58.16
Source: unknown	TCP traffic detected without corresponding DNS query: 144.28.17.252
Source: unknown	TCP traffic detected without corresponding DNS query: 103.25.41.230
Source: unknown	TCP traffic detected without corresponding DNS query: 145.149.117.66
Source: unknown	TCP traffic detected without corresponding DNS query: 179.24.87.106
Source: unknown	TCP traffic detected without corresponding DNS query: 116.219.65.58
Source: unknown	TCP traffic detected without corresponding DNS query: 211.172.61.61
Source: unknown	TCP traffic detected without corresponding DNS query: 96.6.132.177
Source: unknown	TCP traffic detected without corresponding DNS query: 35.30.139.170
Source: unknown	TCP traffic detected without corresponding DNS query: 198.241.152.191
Source: unknown	TCP traffic detected without corresponding DNS query: 170.0.6.187
Source: unknown	TCP traffic detected without corresponding DNS query: 70.226.235.120
Source: unknown	TCP traffic detected without corresponding DNS query: 145.40.23.99
Source: unknown	TCP traffic detected without corresponding DNS query: 135.125.228.227
Source: unknown	TCP traffic detected without corresponding DNS query: 157.77.100.240
Source: unknown	TCP traffic detected without corresponding DNS query: 78.109.39.254
Source: unknown	TCP traffic detected without corresponding DNS query: 90.201.136.107
Source: unknown	TCP traffic detected without corresponding DNS query: 5.235.146.233
Source: unknown	TCP traffic detected without corresponding DNS query: 70.34.62.105
Source: unknown	TCP traffic detected without corresponding DNS query: 182.24.219.137
Source: unknown	TCP traffic detected without corresponding DNS query: 18.60.221.54

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: byte/proc/%d/net/tcp %d: %x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GR

Source: /usr/bin/dbus-daemon (PID: 5549)	File: /proc/5549/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5564)	File: /proc/5564/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5574)	File: /proc/5574/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5709)	File: /proc/5709/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5723)	File: /proc/5723/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5790)	File: /proc/5790/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5873)	File: /proc/5873/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5890)	File: /proc/5890/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5895)	File: /proc/5895/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6044)	File: /proc/6044/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6063)	File: /proc/6063/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6142)	File: /proc/6142/mounts

Source: /lib/systemd/systemd-logind (PID: 5644)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5644)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5729)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5729)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5729)	File: /run/systemd/seats/.#seat06N6xgp	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5813)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5813)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5813)	File: /run/systemd/seats/.#seat0LQimjK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5898)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5898)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5898)	File: /run/systemd/seats/.#seat061cDWc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5980)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5980)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6066)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6066)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6066)	File: /run/systemd/seats/.#seat0cSU8GT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6145)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6145)	Directory: <invalid fd (17)>/..

Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5810/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5810/net/tcp	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5813/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5813/net/tcp	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/6123/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3094/net/tcp	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/1/net/tcp	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5709/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3762/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/801/net/tcp	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3763/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3764/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3765/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5701/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/6135/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/6134/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/6137/net/tcp	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/6136/net/tcp	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/135/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/6127/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/5955/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/260/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/261/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/262/cmdline	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	File opened: /proc/142/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5702)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5704)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5712)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5714)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5716)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5718)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5720)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5791)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5793)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5797)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5799)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5801)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5803)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5875)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5877)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5879)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5883)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5885)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5887)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5959)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5961)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5963)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5965)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5967)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5971)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6042)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6045)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6047)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6049)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6051)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6053)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6128)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6130)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6132)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6134)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6205)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6210)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"

Source: /bin/sh (PID: 5703)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5708)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5713)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5715)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5717)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5719)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5792)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5794)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5798)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5800)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5802)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5804)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5876)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5878)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5880)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5884)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5886)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5888)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5960)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5962)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5964)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5966)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5968)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5972)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6043)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6046)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6048)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6050)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6052)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6054)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6129)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6131)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6133)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6135)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6206)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 782, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 785, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior

Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 3816, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 5347, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 5490, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 785, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior

Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 782, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 2956, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 3094, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 3157, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 3816, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 5347, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 5490, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5507)	SIGKILL sent: pid: 5491, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 661, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 725, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 769, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 785, result: no such process	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 791, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 801, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 940, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1289, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1299, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1300, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 1309, result: successful	Jump to behavior
Source: /tmp/byte.arm.elf (PID: 5513)	SIGKILL sent: pid: 2955, result: successful	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 5724)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5807)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5891)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5975)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6060)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6138)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6212)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6410)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /lib/systemd/systemd-journald (PID: 5573)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5640)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5725)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5808)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5893)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5976)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6061)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6139)	Reads from proc file: /proc/meminfo

Source: /usr/sbin/rsyslogd (PID: 5575)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5641)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5726)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5809)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5892)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6028)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6123)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6140)	Log file created: /var/log/kern.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5701)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5789)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5874)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5955)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6038)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6127)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6202)	Truncated file: /var/log/gpu-manager.log

Source: /tmp/byte.arm.elf (PID: 5505)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5561)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5573)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5575)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5640)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5641)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5701)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5725)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5726)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5789)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5808)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5809)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5892)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5893)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5976)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6028)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6059)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6061)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6123)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6139)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6140)	Queries kernel information via 'uname':

Source: byte.arm.elf, 5505.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5507.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5508.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5511.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5519.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5521.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5522.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5525.1.000055e718de8000.000055e718f16000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: byte.arm.elf, 5505.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5507.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5508.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5511.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5519.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5521.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5522.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5525.1.00007fffc969d000.00007fffc96be000.rw-.sdmp	Binary or memory string: kxx86_64/usr/bin/qemu-arm/tmp/byte.arm.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/byte.arm.elf
Source: byte.arm.elf, 5505.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5507.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5508.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5511.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5519.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5521.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5522.1.000055e718de8000.000055e718f16000.rw-.sdmp, byte.arm.elf, 5525.1.000055e718de8000.000055e718f16000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: byte.arm.elf, 5505.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5507.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5508.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5511.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5519.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5521.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5522.1.00007fffc969d000.00007fffc96be000.rw-.sdmp, byte.arm.elf, 5525.1.00007fffc969d000.00007fffc96be000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm

Source: Yara match	File source: byte.arm.elf, type: SAMPLE
Source: Yara match	File source: 5519.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5507.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5505.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5508.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5522.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5525.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5511.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5521.1.00007f89c8017000.00007f89c802b000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5505, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5507, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5508, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5511, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5519, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5521, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5522, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.arm.elf PID: 5525, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
byte.arm.elf	50%	ReversingLabs	Linux.Backdoor.Bushido
byte.arm.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

IP	Domain	Country	ASN	ASN Name	Malicious
133.185.20.24	unknown	Japan	385	AFCONC-BLOCK1-ASUS	false
160.40.222.54	unknown	Greece	47616	CERTHGR	false
152.17.164.20	unknown	United States	40245	WAKE-FOREST-UNIVERSITYUS	false
114.100.27.193	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
84.148.245.153	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
216.27.102.100	unknown	United States	10466	MAGPIUS	false
171.250.117.243	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
137.26.0.217	unknown	United States	20115	CHARTER-20115US	false
169.215.161.69	unknown	Korea Republic of	37611	AfrihostZA	false
109.134.50.105	unknown	Belgium	5432	PROXIMUS-ISP-ASBE	false
125.201.126.195	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
85.170.55.37	unknown	France	21502	ASN-NUMERICABLEFR	false
44.141.255.204	unknown	United States	1653	SUNETSUNETSwedishUniversityNetworkEU	false
178.39.30.102	unknown	Switzerland	6730	SUNRISECH	false
50.193.107.133	unknown	United States	7922	COMCAST-7922US	false
24.184.104.112	unknown	United States	6128	CABLE-NET-1US	false
156.101.103.204	unknown	United States	20062	WASTE-MANUS	false
93.81.174.189	unknown	Russian Federation	8402	CORBINA-ASOJSCVimpelcomRU	false
61.87.49.156	unknown	Japan	4685	ASAHI-NETAsahiNetJP	false
122.54.41.10	unknown	Philippines	9299	IPG-AS-APPhilippineLongDistanceTelephoneCompanyPH	false
174.152.253.145	unknown	United States	10507	SPCSUS	false
210.29.31.39	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
35.244.42.2	unknown	United States	15169	GOOGLEUS	false
48.31.204.40	unknown	United States	2686	ATGS-MMD-ASUS	false
44.167.47.4	unknown	United States	7377	UCSDUS	false
114.153.83.178	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
72.33.116.201	unknown	United States	59	WISC-MADISON-ASUS	false
79.167.2.25	unknown	Greece	3329	HOL-GRAthensGreeceGR	false
78.173.126.73	unknown	Turkey	9121	TTNETTR	false
51.51.129.67	unknown	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
219.223.93.187	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
41.202.123.153	unknown	Cote D'ivoire	36974	AFNET-ASCI	false
207.69.235.117	unknown	United States	7029	WINDSTREAMUS	false
207.176.249.219	unknown	United States	3491	BTN-ASNUS	false
41.157.169.118	unknown	South Africa	37168	CELL-CZA	false
171.16.48.27	unknown	France	12670	AS-COMPLETELFR	false
119.6.57.130	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
2.10.236.189	unknown	France	3215	FranceTelecom-OrangeFR	false
77.46.208.251	unknown	Serbia	8400	TELEKOM-ASRS	false
35.39.9.154	unknown	United States	36375	UMICH-AS-5US	false
47.227.177.184	unknown	United States	33363	BHN-33363US	false
53.29.58.97	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
85.215.62.133	unknown	Germany	6724	STRATOSTRATOAGDE	false
168.153.155.28	unknown	Australia	2764	AAPTAAPTLimitedAU	false
126.100.171.240	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
48.224.60.138	unknown	United States	2686	ATGS-MMD-ASUS	false
158.175.64.166	unknown	United States	36351	SOFTLAYERUS	false
129.97.144.87	unknown	Canada	12093	UWATERLOOCA	false
32.26.81.184	unknown	United States	2686	ATGS-MMD-ASUS	false
217.242.69.242	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
73.1.74.16	unknown	United States	7922	COMCAST-7922US	false
132.89.214.113	unknown	United States	306	DNIC-ASBLK-00306-00371US	false
158.235.27.238	unknown	United States	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
24.53.216.169	unknown	Japan	18260	E-CATVEHIMECATVCOLTDJP	false
80.212.71.232	unknown	Norway	2119	TELENOR-NEXTELTelenorNorgeASNO	false
49.114.132.70	unknown	China	137694	CHINATELECOM-XINJIANG-KEZHOU-MANCHINATELECOMXinjiangKezho	false
2.179.75.232	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
101.121.70.3	unknown	China	133612	VODAFONE-AS-APVodafoneAustraliaPtyLtdAU	false
39.178.165.38	unknown	China	9808	CMNET-GDGuangdongMobileCommunicationCoLtdCN	false
8.27.61.122	unknown	United States	14112	NET-SECURENET-MTLCA	false
77.4.136.31	unknown	Germany	6805	TDDE-ASN1DE	false
151.32.118.199	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
74.45.166.226	unknown	United States	7011	FRONTIER-AND-CITIZENSUS	false
178.219.2.171	unknown	Serbia	9125	ORIONTELEKOM-ASRS	false
12.120.167.124	unknown	United States	4466	EASYLINK2US	false
213.111.113.10	unknown	Ukraine	48683	BI-LINK-ASUA	false
113.102.166.139	unknown	China	58466	CT-GUANGZHOU-IDCCHINANETGuangdongprovincenetworkCN	false
135.248.177.152	unknown	United States	10455	LUCENT-CIOUS	false
9.27.251.148	unknown	United States	3356	LEVEL3US	false
218.255.133.81	unknown	Hong Kong	9381	HKBNES-AS-APHKBNEnterpriseSolutionsHKLimitedHK	false
108.229.112.69	unknown	United States	36351	SOFTLAYERUS	false
176.81.250.182	unknown	Spain	3352	TELEFONICA_DE_ESPANAES	false
220.54.208.132	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
44.175.219.158	unknown	United States	20473	AS-CHOOPAUS	false
101.235.198.114	unknown	Korea Republic of	7562	HCNSEOCHO-AS-KRHCNDongjakKR	false
112.250.224.203	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
123.169.121.176	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
77.201.116.246	unknown	France	15557	LDCOMNETFR	false
204.192.255.226	unknown	United States	2828	XO-AS15US	false
93.17.161.29	unknown	France	15557	LDCOMNETFR	false
113.175.171.252	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
60.198.32.47	unknown	Taiwan; Republic of China (ROC)	9924	TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi	false
98.54.8.235	unknown	United States	7922	COMCAST-7922US	false
106.83.252.255	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
152.164.194.97	unknown	United States	701	UUNETUS	false
73.145.14.254	unknown	United States	7922	COMCAST-7922US	false
181.73.33.102	unknown	Chile	6535	TelmexServiciosEmpresarialesSACL	false
34.106.111.46	unknown	United States	15169	GOOGLEUS	false
43.35.236.247	unknown	Japan	4249	LILLY-ASUS	false
150.41.133.227	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
59.162.37.17	unknown	India	4755	TATACOMM-ASTATACommunicationsformerlyVSNLisLeadingISP	false
32.253.37.108	unknown	United States	2686	ATGS-MMD-ASUS	false
17.149.252.200	unknown	United States	714	APPLE-ENGINEERINGUS	false
32.122.25.92	unknown	United States	7018	ATT-INTERNET4US	false
213.194.243.250	unknown	Czech Republic	207187	TKRJASEKCZ	false
5.194.146.243	unknown	United Arab Emirates	5384	EMIRATES-INTERNETEmiratesInternetAE	false
98.52.7.99	unknown	United States	7922	COMCAST-7922US	false
67.18.36.143	unknown	United States	36351	SOFTLAYERUS	false
160.244.136.104	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
148.26.55.5	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
216.27.102.100	sjPJ8NA5eM	Get hash	malicious	Mirai	Browse
216.27.102.100	mipsel	Get hash	malicious	Mirai Moobot	Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report byte.arm.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/seats/.#seat061cDWc

/run/systemd/seats/.#seat06N6xgp

/run/systemd/seats/.#seat0LQimjK

/run/systemd/seats/.#seat0cSU8GT

/tmp/qemu-open.09riD2 (deleted)

/tmp/qemu-open.0Bpd74 (deleted)

/tmp/qemu-open.0F1gH5 (deleted)

/tmp/qemu-open.0Fmvd2 (deleted)

/tmp/qemu-open.0L7iN4 (deleted)

/tmp/qemu-open.0PJR65 (deleted)

/tmp/qemu-open.0RAK34 (deleted)

/tmp/qemu-open.0Vylf2 (deleted)

/tmp/qemu-open.0Xi1D3 (deleted)

/tmp/qemu-open.0c74P4 (deleted)

/tmp/qemu-open.0cDTM3 (deleted)

/tmp/qemu-open.0kaPL3 (deleted)

/tmp/qemu-open.0kx142 (deleted)

/tmp/qemu-open.0mhvD4 (deleted)

/tmp/qemu-open.0pov34 (deleted)

/tmp/qemu-open.0zjhs4 (deleted)

/tmp/qemu-open.10G4b2 (deleted)

/tmp/qemu-open.10cAN5 (deleted)

/tmp/qemu-open.13PH35 (deleted)

/tmp/qemu-open.157Td3 (deleted)

/tmp/qemu-open.1AyBp2 (deleted)

/tmp/qemu-open.1E0Do6 (deleted)

/tmp/qemu-open.1E9Si6 (deleted)

/tmp/qemu-open.1Jcnu6 (deleted)

/tmp/qemu-open.1QIb13 (deleted)

/tmp/qemu-open.1U8al6 (deleted)

/tmp/qemu-open.1Wfgi3 (deleted)

Linux Analysis Report
byte.arm.elf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
asdffasdfasdfas.o-r.kr	byte.arm5.elf	Get hash	malicious	Okiru	Browse	154.216.18.116
asdffasdfasdfas.o-r.kr	byte.mips.elf	Get hash	malicious	Okiru	Browse	154.216.18.116

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AFCONC-BLOCK1-ASUS	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	132.30.0.20
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	133.182.22.246
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	131.40.214.196
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	132.63.145.230
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	215.75.83.231
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	129.238.128.134
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	137.242.127.249
	bin.x86_64.elf	Get hash	malicious	Gafgyt, Mirai	Browse	139.241.20.211
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	129.239.230.232
	bin.i686.elf	Get hash	malicious	Gafgyt, Mirai	Browse	134.72.60.80
WAKE-FOREST-UNIVERSITYUS	79VAlgfTk8.elf	Get hash	malicious	Mirai	Browse	152.17.191.217
	vQPpTr8mfm.elf	Get hash	malicious	Mirai	Browse	152.17.81.207
	6RO84oS26Q.elf	Get hash	malicious	Mirai	Browse	152.17.230.56
	SjLTg00G6b.elf	Get hash	malicious	Mirai	Browse	152.17.230.86
	9g5gIOlb47.elf	Get hash	malicious	Mirai	Browse	152.17.81.206
	ZMDO0vznFx.elf	Get hash	malicious	Unknown	Browse	152.17.119.151
	PcYRqnCfZK.elf	Get hash	malicious	Mirai	Browse	152.17.230.71
	QEMy2mlwhJ.elf	Get hash	malicious	Mirai	Browse	152.17.205.98
	UKWMnIKfp2.elf	Get hash	malicious	Unknown	Browse	152.17.205.90
	SecuriteInfo.com.Linux.Siggen.9999.2598.31132.elf	Get hash	malicious	Mirai	Browse	152.17.230.96
CERTHGR	arm5.nn-20241014-0317.elf	Get hash	malicious	Mirai, Okiru	Browse	160.40.210.75
	na.elf	Get hash	malicious	Mirai	Browse	160.40.127.116
	skt.arm6.elf	Get hash	malicious	Mirai	Browse	160.40.127.134
	ODOCVzwXq5.elf	Get hash	malicious	Mirai	Browse	160.40.196.85
	tOcp0Aywsi.elf	Get hash	malicious	Mirai, Moobot	Browse	160.41.59.25
	yzIY5KFJSu.elf	Get hash	malicious	Mirai	Browse	160.40.127.130
	SecuriteInfo.com.Linux.Siggen.9999.12773.8422.elf	Get hash	malicious	Mirai	Browse	160.41.59.19
	pm71xWvAqP.elf	Get hash	malicious	Moobot	Browse	160.40.127.138
	T3JZ5uPdFZ.elf	Get hash	malicious	Mirai	Browse	160.40.127.164
	db0fa4b8db0333367e9bda3ab68b8042.sh4	Get hash	malicious	Mirai	Browse	160.40.2.193
CHINANET-BACKBONENo31Jin-rongStreetCN	byte.mips.elf	Get hash	malicious	Okiru	Browse	114.220.140.121
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	106.238.35.191
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	115.148.5.2
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	61.144.45.36
	la.bot.mips.elf	Get hash	malicious	Unknown	Browse	110.153.100.55
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	118.125.163.237
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	171.91.95.21
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	111.76.242.234
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	116.55.145.245
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	113.90.226.188

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

Process:	/tmp/byte.arm.elf
File Type:	data
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.614369445886757
Encrypted:	false
SSDEEP:	3:Tg65:Tg65
MD5:	DDF85A4449773FE0B4E149A591B091A1
SHA1:	1261C3E065D1028F136B119BFDBE217D3783B8B1
SHA-256:	E470358CA7A09BDEBE3092F86AFB6098999CEA74654D5664BCE1727B994848EA
SHA-512:	DBEDA1C7627457CC9651AB4A05E0D3941916F4968BF95B65B4A960F98BB6263E6212E3A3D9CAA830869B558173CC8BD435D54633D071F440311C09FD66EBE3EC
Malicious:	false
Reputation:	low
Preview:	/tmp/byte.arm.elf.

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31Hl9idQlXl1idQ/:F3tvlXDv
MD5:	EBB9AD06EB99916D09621F00962209BA
SHA1:	1D70A8444E86A8D9907AA9B8984C031ADC9595B1
SHA-256:	1C8D5F451ED3EAD82662E4F3B201740B25FADC1EF447BED7C3CB848F8FCEB551
SHA-512:	699B103507B9648310E8C3A782A104BEEB3DD9AA032703AA4647AF8CB0F4E4EE27859354A59CC3F9823E0D4DD1091EE78C3641C45CB0210373C5C5512F5AB779
Malicious:	false
Preview:	LPKSHHRH................0.,.5oD\|.. ....5................................0.,.5oD\|.. ....5........................................................................................................................................................

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2334
Entropy (8bit):	4.77742310523202
Encrypted:	false
SSDEEP:	48:rNJUVNvfRQdjEmqH0dDGRzHS0nIEkbWhavjm6Ox7NBEDDWUD:pe2LYIGh+ZD
MD5:	143110711A2277E0D131F3AA3C9394E0
SHA1:	CC773E069FF1E5671D47C07CF26B3294046CCEA1
SHA-256:	1676388FD7E03DBDAD70547DAA8526C71D27C928D8E1B89A9B0E248F0296C075
SHA-512:	3AF08E23C57B12AD9EBC983A0054B5DADFE531912D61DE16C10631E78809D0B4AC83FD45EE68E56D321815C9F0461EC4CC2A52ABDA38A478A6C251B5742F7B61
Malicious:	false
Preview:	Oct 23 06:35:10 galassia kernel: [ 146.192369] Reached call limit: pid 5513, name read.Oct 23 06:35:10 galassia kernel: [ 146.347912] blocking signal 9: 5513 -> 1.Oct 23 06:35:10 galassia kernel: [ 146.386956] blocking signal 9: 5513 -> 661.Oct 23 06:35:10 galassia kernel: [ 146.387151] New task spawned: old: (tgid 6137, tid 6137), new (tgid: 6138, tid: 6138).Oct 23 06:35:10 galassia kernel: [ 146.403955] blocking signal 9: 5513 -> 725.Oct 23 06:35:10 galassia kernel: [ 146.422185] blocking signal 9: 5513 -> 767.Oct 23 06:35:10 galassia kernel: [ 146.438590] blocking signal 9: 5513 -> 769.Oct 23 06:35:10 galassia kernel: [ 146.452206] blocking signal 9: 5513 -> 780.Oct 23 06:35:10 galassia kernel: [ 146.473866] blocking signal 9: 5513 -> 940.Oct 23 06:35:10 galassia kernel: [ 146.493832] blocking signal 9: 5513 -> 1299.Oct 23 06:35:10 galassia kernel: [ 146.505057] blocking signal 9: 5513 -> 1300.Oct 23 06:35:10 galassia kernel: [ 146.525258] blocking signal 9: 5513 -> 2955

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	6.092956779719157
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	byte.arm.elf
File size:	85'476 bytes
MD5:	a59ec8a40225153c5e227ddb42c2026e
SHA1:	51733d2e5fb47114c06659978ca28954136a7e30
SHA256:	e8d88c892972d0f61f915bbc8581d83a14ef86c6495d8406dba94adaeee96f19
SHA512:	934b340231e97c20c5569e675310f32390cd170cf23e13fa0c15fc26cec49e27f011e4d3ed8fb1bcef09f6a0aae416119fffb1d2bb2e04fabd366bfc9f10c641
SSDEEP:	1536:XeWzsqrcBu0LIj8JqftvYVljjqJzVXyEcFwiIvFl61d6L:XeqssWIjhSlnAVD3F4a
TLSH:	6D835B91BC815A13C6D1527BFB2E428C371653A8D2EF32079D25AF11378B92F0E7B652
File Content Preview:	.ELF...a..........(.........4...TL......4. ...(......................8...8...............@...@...@..................Q.td..................................-...L."....C..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	85076
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x10f9c	0x0	0x6	AX	16
.fini	PROGBITS	0x1904c	0x1104c	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x19060	0x11060	0x2874	0x0	0x2	A	4
.ctors	PROGBITS	0x24000	0x14000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x24008	0x14008	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x24014	0x14014	0xc00	0x0	0x3	WA	4
.bss	NOBITS	0x24c14	0x14c14	0x228c	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x14c14	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x138d4	0x138d4	6.1976	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x14000	0x24000	0x24000	0xc14	0x2ea0	4.0484	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4