Edit tour

Linux Analysis Report
byte.mpsl.elf

Overview

General Information

Sample name:	byte.mpsl.elf
Analysis ID:	1540134
MD5:	85005d41fbe2af79bdcb879bf576cdd0
SHA1:	9550cf3e0af79aaa42d7569241c04c125f743a55
SHA256:	a4414f00a4b4028851b6d838bac84edc0514b90d0acf2d373f8546ccbb0067bc
Tags:	elfuser-abuse_ch
Infos:

Detection

Okiru

Score:	80
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Okiru

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540134
Start date and time:	2024-10-23 13:34:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	byte.mpsl.elf
Detection:	MAL
Classification:	mal80.spre.troj.linELF@0/1048@2/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: byte.mpsl.elf

Runtime Messages

Command:	/tmp/byte.mpsl.elf
PID:	5432
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	Connected To CNC
Standard Error:

Process Tree

system is lnxubuntu20

byte.mpsl.elf (PID: 5432, Parent: 5356, MD5: 0d6f61f82cf2f781c6eb0661071d42d9) Arguments: /tmp/byte.mpsl.elf

byte.mpsl.elf New Fork (PID: 5434, Parent: 5432)

byte.mpsl.elf New Fork (PID: 5436, Parent: 5432)

byte.mpsl.elf New Fork (PID: 5438, Parent: 5432)

byte.mpsl.elf New Fork (PID: 5440, Parent: 5438)

byte.mpsl.elf New Fork (PID: 5442, Parent: 5438)

byte.mpsl.elf New Fork (PID: 5444, Parent: 5438)

byte.mpsl.elf New Fork (PID: 5445, Parent: 5438)

byte.mpsl.elf New Fork (PID: 5448, Parent: 5438)

systemd New Fork (PID: 5451, Parent: 1)

journalctl (PID: 5451, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5473, Parent: 1)

dbus-daemon (PID: 5473, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5484, Parent: 1)

rsyslogd (PID: 5484, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gvfsd-fuse New Fork (PID: 5485, Parent: 3122)

fusermount (PID: 5485, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5486, Parent: 2935)

pulseaudio (PID: 5486, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 5492, Parent: 1)

systemd-journald (PID: 5492, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5493, Parent: 1)

dbus-daemon (PID: 5493, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5494, Parent: 1)

systemd-journald (PID: 5494, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5497, Parent: 1)

rsyslogd (PID: 5497, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5503, Parent: 1)

systemd-logind (PID: 5503, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

gdm3 New Fork (PID: 5560, Parent: 1400)

Default (PID: 5560, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5561, Parent: 1400)

Default (PID: 5561, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5562, Parent: 1400)

Default (PID: 5562, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5563, Parent: 1)

rsyslogd (PID: 5563, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5564, Parent: 1)

systemd-journald (PID: 5564, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5567, Parent: 1)

systemd-logind (PID: 5567, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5624, Parent: 1)

rsyslogd (PID: 5624, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5625, Parent: 1)

gpu-manager (PID: 5625, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5626, Parent: 5625)

sh (PID: 5626, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5630, Parent: 5626)

grep (PID: 5630, Parent: 5626, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5631, Parent: 5625)

sh (PID: 5631, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5632, Parent: 5631)

grep (PID: 5632, Parent: 5631, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5634, Parent: 5625)

sh (PID: 5634, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5635, Parent: 5634)

grep (PID: 5635, Parent: 5634, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5638, Parent: 5625)

sh (PID: 5638, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5639, Parent: 5638)

grep (PID: 5639, Parent: 5638, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5640, Parent: 5625)

sh (PID: 5640, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5641, Parent: 5640)

grep (PID: 5641, Parent: 5640, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5642, Parent: 5625)

sh (PID: 5642, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5643, Parent: 5642)

grep (PID: 5643, Parent: 5642, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5633, Parent: 1)

dbus-daemon (PID: 5633, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5644, Parent: 1)

generate-config (PID: 5644, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5646, Parent: 5644)

pkill (PID: 5646, Parent: 5644, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5645, Parent: 1)

dbus-daemon (PID: 5645, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5647, Parent: 1)

systemd-journald (PID: 5647, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5648, Parent: 1)

rsyslogd (PID: 5648, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5649, Parent: 1)

dbus-daemon (PID: 5649, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5652, Parent: 1)

systemd-logind (PID: 5652, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5709, Parent: 1)

gpu-manager (PID: 5709, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5710, Parent: 5709)

sh (PID: 5710, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5711, Parent: 5710)

grep (PID: 5711, Parent: 5710, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5715, Parent: 5709)

sh (PID: 5715, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5716, Parent: 5715)

grep (PID: 5716, Parent: 5715, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5717, Parent: 5709)

sh (PID: 5717, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5718, Parent: 5717)

grep (PID: 5718, Parent: 5717, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5719, Parent: 5709)

sh (PID: 5719, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5720, Parent: 5719)

grep (PID: 5720, Parent: 5719, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5721, Parent: 5709)

sh (PID: 5721, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5722, Parent: 5721)

grep (PID: 5722, Parent: 5721, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5725, Parent: 5709)

sh (PID: 5725, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5726, Parent: 5725)

grep (PID: 5726, Parent: 5725, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5727, Parent: 5709)

sh (PID: 5727, Parent: 5709, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5728, Parent: 5727)

grep (PID: 5728, Parent: 5727, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5729, Parent: 1)

generate-config (PID: 5729, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5731, Parent: 5729)

pkill (PID: 5731, Parent: 5729, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5730, Parent: 1)

rsyslogd (PID: 5730, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5732, Parent: 1)

systemd-journald (PID: 5732, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5735, Parent: 1)

systemd-logind (PID: 5735, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5792, Parent: 1)

rsyslogd (PID: 5792, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5793, Parent: 1)

gpu-manager (PID: 5793, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5797, Parent: 5793)

sh (PID: 5797, Parent: 5793, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5798, Parent: 5797)

grep (PID: 5798, Parent: 5797, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5800, Parent: 5793)

sh (PID: 5800, Parent: 5793, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5801, Parent: 5800)

grep (PID: 5801, Parent: 5800, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5802, Parent: 5793)

sh (PID: 5802, Parent: 5793, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5803, Parent: 5802)

grep (PID: 5803, Parent: 5802, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5804, Parent: 5793)

sh (PID: 5804, Parent: 5793, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5805, Parent: 5804)

grep (PID: 5805, Parent: 5804, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5806, Parent: 5793)

sh (PID: 5806, Parent: 5793, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5807, Parent: 5806)

grep (PID: 5807, Parent: 5806, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5808, Parent: 5793)

sh (PID: 5808, Parent: 5793, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5809, Parent: 5808)

grep (PID: 5809, Parent: 5808, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5799, Parent: 1)

dbus-daemon (PID: 5799, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5812, Parent: 1)

generate-config (PID: 5812, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5814, Parent: 5812)

pkill (PID: 5814, Parent: 5812, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5813, Parent: 1)

rsyslogd (PID: 5813, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5815, Parent: 1)

systemd-journald (PID: 5815, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5818, Parent: 1)

systemd-logind (PID: 5818, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5875, Parent: 1)

rsyslogd (PID: 5875, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5879, Parent: 1)

dbus-daemon (PID: 5879, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5880, Parent: 1)

gpu-manager (PID: 5880, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5881, Parent: 5880)

sh (PID: 5881, Parent: 5880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5882, Parent: 5881)

grep (PID: 5882, Parent: 5881, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5883, Parent: 5880)

sh (PID: 5883, Parent: 5880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5884, Parent: 5883)

grep (PID: 5884, Parent: 5883, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5885, Parent: 5880)

sh (PID: 5885, Parent: 5880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5886, Parent: 5885)

grep (PID: 5886, Parent: 5885, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5887, Parent: 5880)

sh (PID: 5887, Parent: 5880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5888, Parent: 5887)

grep (PID: 5888, Parent: 5887, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5889, Parent: 1)

generate-config (PID: 5889, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5891, Parent: 5889)

pkill (PID: 5891, Parent: 5889, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5890, Parent: 1)

dbus-daemon (PID: 5890, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5892, Parent: 1)

rsyslogd (PID: 5892, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5893, Parent: 1)

systemd-journald (PID: 5893, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5894, Parent: 1)

dbus-daemon (PID: 5894, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5897, Parent: 1)

systemd-logind (PID: 5897, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5956, Parent: 1)

gpu-manager (PID: 5956, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5957, Parent: 5956)

sh (PID: 5957, Parent: 5956, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5958, Parent: 5957)

grep (PID: 5958, Parent: 5957, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5959, Parent: 5956)

sh (PID: 5959, Parent: 5956, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5960, Parent: 5959)

grep (PID: 5960, Parent: 5959, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5961, Parent: 5956)

sh (PID: 5961, Parent: 5956, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5962, Parent: 5961)

grep (PID: 5962, Parent: 5961, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5963, Parent: 5956)

sh (PID: 5963, Parent: 5956, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5964, Parent: 5963)

grep (PID: 5964, Parent: 5963, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5965, Parent: 5956)

sh (PID: 5965, Parent: 5956, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5966, Parent: 5965)

grep (PID: 5966, Parent: 5965, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5967, Parent: 5956)

sh (PID: 5967, Parent: 5956, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5968, Parent: 5967)

grep (PID: 5968, Parent: 5967, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5969, Parent: 1)

generate-config (PID: 5969, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5970, Parent: 5969)

pkill (PID: 5970, Parent: 5969, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5971, Parent: 1)

systemd-journald (PID: 5971, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5974, Parent: 1)

systemd-logind (PID: 5974, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6031, Parent: 1)

gpu-manager (PID: 6031, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6033, Parent: 6031)

sh (PID: 6033, Parent: 6031, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6034, Parent: 6033)

grep (PID: 6034, Parent: 6033, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6035, Parent: 6031)

sh (PID: 6035, Parent: 6031, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6036, Parent: 6035)

grep (PID: 6036, Parent: 6035, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6037, Parent: 6031)

sh (PID: 6037, Parent: 6031, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6038, Parent: 6037)

grep (PID: 6038, Parent: 6037, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6039, Parent: 6031)

sh (PID: 6039, Parent: 6031, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6042, Parent: 6039)

grep (PID: 6042, Parent: 6039, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6043, Parent: 6031)

sh (PID: 6043, Parent: 6031, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6044, Parent: 6043)

grep (PID: 6044, Parent: 6043, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6032, Parent: 1)

dbus-daemon (PID: 6032, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6045, Parent: 1)

generate-config (PID: 6045, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6046, Parent: 6045)

pkill (PID: 6046, Parent: 6045, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6047, Parent: 1)

systemd-journald (PID: 6047, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6050, Parent: 1)

systemd-logind (PID: 6050, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6107, Parent: 1)

dbus-daemon (PID: 6107, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6108, Parent: 1)

dbus-daemon (PID: 6108, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6109, Parent: 1)

gpu-manager (PID: 6109, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6110, Parent: 1)

dbus-daemon (PID: 6110, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6111, Parent: 1)

generate-config (PID: 6111, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6112, Parent: 1)

systemd-journald (PID: 6112, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6115, Parent: 1)

systemd-logind (PID: 6115, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6172, Parent: 1)

dbus-daemon (PID: 6172, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6173, Parent: 1)

systemd-journald (PID: 6173, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6176, Parent: 1)

systemd-logind (PID: 6176, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6235, Parent: 1)

systemd-logind (PID: 6235, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6237, Parent: 1)

systemd-journald (PID: 6237, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6323, Parent: 1)

gpu-manager (PID: 6323, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6324, Parent: 1)

generate-config (PID: 6324, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6325, Parent: 1)

gpu-manager (PID: 6325, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6326, Parent: 1)

generate-config (PID: 6326, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6330, Parent: 1)

generate-config (PID: 6330, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6331, Parent: 1)

gpu-manager (PID: 6331, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6332, Parent: 1)

generate-config (PID: 6332, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6333, Parent: 1)

gpu-manager (PID: 6333, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6334, Parent: 1)

generate-config (PID: 6334, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6335, Parent: 1)

generate-config (PID: 6335, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6336, Parent: 1)

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
byte.mpsl.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security

Memory Dumps

Source	Rule	Description	Author
5436.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5448.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5445.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5442.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5432.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5434.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5444.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5438.1.00007f72ec400000.00007f72ec418000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5432	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5434	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5436	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5438	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5442	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5444	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5445	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mpsl.elf PID: 5448	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Click to see the 11 entries

String: 'byte/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAmnes

Source: /usr/bin/pkill (PID: 5731)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior
Source: /usr/bin/pkill (PID: 5891)	Reads CPU info from /sys: /sys/devices/system/cpu/online			Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5484)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5497)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5648)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5792)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5813)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5875)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5494)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5564)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5647)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5732)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5815)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5893)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5971)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6047)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 130.22.98.191
Source: unknown	TCP traffic detected without corresponding DNS query: 2.131.216.171
Source: unknown	TCP traffic detected without corresponding DNS query: 197.234.67.161
Source: unknown	TCP traffic detected without corresponding DNS query: 206.154.3.177
Source: unknown	TCP traffic detected without corresponding DNS query: 175.149.201.34
Source: unknown	TCP traffic detected without corresponding DNS query: 95.157.38.147
Source: unknown	TCP traffic detected without corresponding DNS query: 88.115.195.69
Source: unknown	TCP traffic detected without corresponding DNS query: 50.249.107.136
Source: unknown	TCP traffic detected without corresponding DNS query: 101.166.65.19
Source: unknown	TCP traffic detected without corresponding DNS query: 104.16.23.233
Source: unknown	TCP traffic detected without corresponding DNS query: 145.99.82.172
Source: unknown	TCP traffic detected without corresponding DNS query: 128.149.16.41
Source: unknown	TCP traffic detected without corresponding DNS query: 206.221.54.213
Source: unknown	TCP traffic detected without corresponding DNS query: 208.58.4.211
Source: unknown	TCP traffic detected without corresponding DNS query: 205.71.80.170
Source: unknown	TCP traffic detected without corresponding DNS query: 168.16.166.111
Source: unknown	TCP traffic detected without corresponding DNS query: 14.161.121.97
Source: unknown	TCP traffic detected without corresponding DNS query: 86.149.43.229
Source: unknown	TCP traffic detected without corresponding DNS query: 18.108.15.202
Source: unknown	TCP traffic detected without corresponding DNS query: 150.249.190.109
Source: unknown	TCP traffic detected without corresponding DNS query: 23.204.98.118
Source: unknown	TCP traffic detected without corresponding DNS query: 185.191.118.10
Source: unknown	TCP traffic detected without corresponding DNS query: 205.36.119.209
Source: unknown	TCP traffic detected without corresponding DNS query: 91.157.200.148
Source: unknown	TCP traffic detected without corresponding DNS query: 57.170.192.95
Source: unknown	TCP traffic detected without corresponding DNS query: 120.228.9.255
Source: unknown	TCP traffic detected without corresponding DNS query: 213.7.58.255
Source: unknown	TCP traffic detected without corresponding DNS query: 23.150.219.231
Source: unknown	TCP traffic detected without corresponding DNS query: 51.117.243.215
Source: unknown	TCP traffic detected without corresponding DNS query: 166.241.88.210
Source: unknown	TCP traffic detected without corresponding DNS query: 32.106.224.174
Source: unknown	TCP traffic detected without corresponding DNS query: 182.247.105.151
Source: unknown	TCP traffic detected without corresponding DNS query: 8.28.218.110
Source: unknown	TCP traffic detected without corresponding DNS query: 17.112.46.123
Source: unknown	TCP traffic detected without corresponding DNS query: 201.56.96.48
Source: unknown	TCP traffic detected without corresponding DNS query: 109.249.222.32
Source: unknown	TCP traffic detected without corresponding DNS query: 183.24.104.198
Source: unknown	TCP traffic detected without corresponding DNS query: 141.99.36.252
Source: unknown	TCP traffic detected without corresponding DNS query: 191.78.31.28
Source: unknown	TCP traffic detected without corresponding DNS query: 192.89.170.62
Source: unknown	TCP traffic detected without corresponding DNS query: 170.227.81.162
Source: unknown	TCP traffic detected without corresponding DNS query: 20.184.215.217
Source: unknown	TCP traffic detected without corresponding DNS query: 42.56.222.118
Source: unknown	TCP traffic detected without corresponding DNS query: 219.62.249.191
Source: unknown	TCP traffic detected without corresponding DNS query: 40.237.28.67
Source: unknown	TCP traffic detected without corresponding DNS query: 85.81.53.97
Source: unknown	TCP traffic detected without corresponding DNS query: 118.84.151.37
Source: unknown	TCP traffic detected without corresponding DNS query: 27.20.183.182
Source: unknown	TCP traffic detected without corresponding DNS query: 180.54.9.156
Source: unknown	TCP traffic detected without corresponding DNS query: 142.65.200.223

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: 'byte/proc/%d/net/tcp %d: %x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919G

Source: /usr/bin/dbus-daemon (PID: 5473)	File: /proc/5473/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5485)	File: /proc/5485/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5493)	File: /proc/5493/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5633)	File: /proc/5633/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5645)	File: /proc/5645/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5649)	File: /proc/5649/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5799)	File: /proc/5799/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5879)	File: /proc/5879/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5894)	File: /proc/5894/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6032)	File: /proc/6032/mounts	Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 5567)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5567)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5567)	File: /run/systemd/seats/.#seat0p0VMpb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5652)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5652)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5652)	File: /run/systemd/seats/.#seat0efH5hy	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5735)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5735)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5735)	File: /run/systemd/seats/.#seat0Fm52oR	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5818)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5818)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5818)	File: /run/systemd/seats/.#seat0W0UBb9	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5897)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5897)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5897)	File: /run/systemd/seats/.#seat0ZnCYb4	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5974)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5974)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5974)	File: /run/systemd/seats/.#seat0YfHRGW	Jump to behavior

Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/3761/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5818/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5818/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5812/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5813/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5815/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5815/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5275/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/3095/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/1/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5709/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/800/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/3420/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/1475/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/936/net/tcp	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	File opened: /proc/30/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5626)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5631)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5634)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5638)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5640)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5642)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5710)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5715)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5717)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5719)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5721)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5725)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5727)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5797)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5800)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5802)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5804)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5806)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5808)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5881)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5883)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5885)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5887)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5957)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5959)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5961)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5963)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5965)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5967)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6033)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6035)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6037)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6039)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6043)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior

Source: /bin/sh (PID: 5630)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5632)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5635)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5639)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5641)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5643)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5711)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5716)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5718)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5720)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5722)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5726)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5728)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5798)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5801)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5803)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5805)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5807)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5809)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5882)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5884)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5886)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5888)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5958)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5960)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5962)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5964)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5966)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5968)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6034)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6036)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6038)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6042)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6044)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior

Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 790, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 795, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior

Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 790, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 795, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3761, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 5416, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 5417, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 790, result: successful	Jump to behavior

Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 790, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 795, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3122, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 3761, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 5416, result: no such process	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 5417, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5434)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mpsl.elf (PID: 5440)	SIGKILL sent: pid: 790, result: successful	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 5646)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5731)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5814)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5891)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5970)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6046)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5494)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5564)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5647)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5732)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5815)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5893)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5971)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6047)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5497)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5624)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5648)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5792)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5875)	Log file created: /var/log/kern.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5625)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5709)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5793)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5880)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5956)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6031)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: /tmp/byte.mpsl.elf (PID: 5432)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5484)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5494)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5497)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5563)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5564)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5625)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5647)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5648)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5709)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5730)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5732)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5792)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5793)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5813)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5815)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5875)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5893)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5971)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6047)	Queries kernel information via 'uname':	Jump to behavior

Source: kern.log.38.dr	Binary or memory string: Oct 23 06:34:51 galassia kernel: [ 106.107340] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020
Source: byte.mpsl.elf, 5432.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5434.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5436.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5438.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5442.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5444.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5445.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5448.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-mipsel/tmp/byte.mpsl.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/byte.mpsl.elf
Source: byte.mpsl.elf, 5432.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5434.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5436.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5438.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5442.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5444.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5445.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5448.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mipsel
Source: byte.mpsl.elf, 5432.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5434.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5436.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5438.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5442.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5444.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5445.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp, byte.mpsl.elf, 5448.1.0000561c0ccee000.0000561c0cd75000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/mipsel
Source: kern.log.38.dr	Binary or memory string: Oct 23 06:34:51 galassia kernel: [ 106.107312] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse mptspi scsi_transport_spi ahci mptscsih libahci mptbase vmxnet3
Source: byte.mpsl.elf, 5432.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5434.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5436.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5438.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5442.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5444.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5445.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp, byte.mpsl.elf, 5448.1.00007ffe812b7000.00007ffe812d8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mipsel

Source: Yara match	File source: byte.mpsl.elf, type: SAMPLE
Source: Yara match	File source: 5436.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5448.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5445.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5442.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5432.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5434.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f72ec400000.00007f72ec418000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5432, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5434, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5436, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5442, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5445, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mpsl.elf PID: 5448, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
byte.mpsl.elf	47%	ReversingLabs	Linux.Trojan.Mirai
byte.mpsl.elf	100%	Avira	EXP/ELF.Mirai.Bootnet.o

IP	Domain	Country	ASN	ASN Name	Malicious
77.101.159.15	unknown	United Kingdom	5089	NTLGB	false
177.27.16.207	unknown	Brazil	26599	TELEFONICABRASILSABR	false
219.95.152.107	unknown	Malaysia	4788	TMNET-AS-APTMNetInternetServiceProviderMY	false
4.144.23.62	unknown	United States	3356	LEVEL3US	false
142.24.211.176	unknown	Canada	3633	PROVINCE-OF-BRITISH-COLUMBIACA	false
133.83.192.142	unknown	Japan	2907	SINET-ASResearchOrganizationofInformationandSystemsN	false
167.176.110.226	unknown	United States	59447	SAYFANETTR	false
140.14.120.105	unknown	United States	23700	FASTNET-AS-IDLinknet-FastnetASNID	false
128.149.16.41	unknown	United States	127	JPL-AS127US	false
150.132.9.209	unknown	Sweden	158	ERI-ASUS	false
152.157.241.115	unknown	United States	10430	WA-K20US	false
65.121.213.146	unknown	United States	27235	CVC-INET-33US	false
62.123.20.129	unknown	Italy	12797	ASN-ATLANETIT	false
133.215.63.149	unknown	Japan	2497	IIJInternetInitiativeJapanIncJP	false
96.143.66.206	unknown	United States	7922	COMCAST-7922US	false
31.201.173.51	unknown	Netherlands	50266	TMOBILE-THUISNL	false
204.203.211.34	unknown	United States	2914	NTT-COMMUNICATIONS-2914US	false
25.199.222.134	unknown	United Kingdom	7922	COMCAST-7922US	false
216.140.244.124	unknown	United States	3356	LEVEL3US	false
181.122.132.98	unknown	Paraguay	23201	TelecelSAPY	false
32.195.180.65	unknown	United States	2686	ATGS-MMD-ASUS	false
5.104.202.76	unknown	Russian Federation	50498	LIPETSK-ASRU	false
124.254.109.120	unknown	Australia	4826	VOCUS-BACKBONE-ASVocusConnectInternationalBackboneAU	false
159.124.100.81	unknown	United States	16983	AS16983US	false
184.117.85.192	unknown	United States	7922	COMCAST-7922US	false
174.215.139.32	unknown	United States	22394	CELLCOUS	false
116.155.194.14	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
41.188.65.205	unknown	Mauritania	29544	MAURITELMR	false
14.138.97.252	unknown	Korea Republic of	9943	KNCTV-ASKangNamCableTVKR	false
185.111.176.179	unknown	Switzerland	20874	INFOSYSLB	false
187.64.51.29	unknown	Brazil	28573	CLAROSABR	false
117.87.40.24	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
8.129.243.142	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
116.68.243.127	unknown	India	38571	SBS-ISP-ASStarBroadbandServicesIN	false
74.161.122.236	unknown	United States	10796	TWC-10796-MIDWESTUS	false
18.164.234.77	unknown	United States	3	MIT-GATEWAYSUS	false
79.99.1.65	unknown	Sweden	43948	GLESYS-ASSE	false
159.100.169.118	unknown	United Kingdom	53766	VELOCLOUDUS	false
141.79.168.13	unknown	Germany	553	BELWUEBelWue-KoordinationEU	false
27.207.190.156	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
207.45.88.35	unknown	United States	30462	NEXGENUS	false
201.29.208.235	unknown	Brazil	7738	TelemarNorteLesteSABR	false
220.172.29.208	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
133.118.204.94	unknown	Japan	2522	PPP-EXPJapanNetworkInformationCenterJP	false
220.190.194.60	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
194.215.175.116	unknown	Finland	1759	TSF-IP-CORETeliaFinlandOyjEU	false
147.63.101.81	unknown	United States	4193	WA-STATE-GOVUS	false
19.209.203.214	unknown	United States	3	MIT-GATEWAYSUS	false
47.145.89.100	unknown	United States	5650	FRONTIER-FRTRUS	false
108.141.212.199	unknown	United States	16509	AMAZON-02US	false
172.119.88.99	unknown	United States	20001	TWC-20001-PACWESTUS	false
20.140.2.145	unknown	United States	8070	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
222.120.14.252	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
124.206.69.233	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
123.112.188.70	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
85.51.233.198	unknown	Spain	12479	UNI2-ASES	false
105.168.252.2	unknown	Angola	37119	unitel-ASAO	false
80.73.245.153	unknown	Austria	31034	ARUBA-ASNIT	false
167.183.198.242	unknown	United States	59447	SAYFANETTR	false
205.91.157.243	unknown	United States	3475	DNIC-AS-03475US	false
202.115.42.127	unknown	China	24355	CNGI-CD-IX-AS-APCERNET2IXatUniversityofElectronicScie	false
52.36.53.152	unknown	United States	16509	AMAZON-02US	false
159.171.18.5	unknown	Norway	25400	TELIA-NORWAY-ASTeliaNorwayCoreNetworksNO	false
208.74.162.95	unknown	United States	13649	ASN-VINSUS	false
36.113.53.164	unknown	China	137689	CHINATELECOM-IOT-JIANGSU-NETWORKIOTJiangsunetworkChinat	false
196.161.126.206	unknown	South Africa	328065	Vast-Networks-ASZA	false
180.201.235.242	unknown	China	4538	ERX-CERNET-BKBChinaEducationandResearchNetworkCenter	false
223.241.38.203	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
180.75.159.153	unknown	Malaysia	38322	WEBE-MY-AS-APWEBEDIGITALSDNBHDMY	false
20.90.174.127	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
198.105.119.15	unknown	European Union	61317	ASDETUKhttpwwwheficedcomGB	false
98.198.42.54	unknown	United States	7922	COMCAST-7922US	false
148.52.198.72	unknown	United States	721	DNIC-ASBLK-00721-00726US	false
90.194.151.182	unknown	United Kingdom	5607	BSKYB-BROADBAND-ASGB	false
63.181.44.135	unknown	United States	1239	SPRINTLINKUS	false
73.249.141.94	unknown	United States	7922	COMCAST-7922US	false
74.64.31.151	unknown	United States	12271	TWC-12271-NYCUS	false
124.24.132.47	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
181.128.202.164	unknown	Colombia	13489	EPMTelecomunicacionesSAESPCO	false
95.15.16.128	unknown	Turkey	9121	TTNETTR	false
186.150.12.217	unknown	Dominican Republic	28118	ALTICEDOMINICANASADO	false
111.206.232.212	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
59.189.223.17	unknown	Singapore	10091	STARHUB-CABLEStarHubLtdSG	false
92.111.20.40	unknown	Netherlands	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
68.174.131.114	unknown	United States	12271	TWC-12271-NYCUS	false
51.4.35.213	unknown	Germany	200517	MS-DEUTSCHLANDDE	false
204.220.37.77	unknown	United States	5006	VOYANTUS	false
27.212.123.209	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
177.129.224.152	unknown	Brazil	263049	NIPPONTECTELECOMUNICACOESBR	false
135.28.160.154	unknown	United States	54614	CIKTELECOM-CABLECA	false
61.13.105.191	unknown	Singapore	17820	DIL-APDIRECTINTERNETLTDIN	false
171.230.67.185	unknown	Viet Nam	7552	VIETEL-AS-APViettelGroupVN	false
89.197.87.244	unknown	United Kingdom	47474	VIRTUAL1GB	false
110.6.207.10	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
223.134.134.16	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
112.88.168.187	unknown	China	17816	CHINA169-GZChinaUnicomIPnetworkChina169Guangdongprovi	false
63.127.123.101	unknown	United States	701	UUNETUS	false
73.243.187.254	unknown	United States	7922	COMCAST-7922US	false
62.203.218.33	unknown	Switzerland	3303	SWISSCOMSwisscomSwitzerlandLtdCH	false
166.83.8.110	unknown	New Zealand	7029	WINDSTREAMUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.111.176.179	vbLINaY1Ls.elf	Get hash	malicious	Mirai	Browse
62.123.20.129	yJPYaQh5ak	Get hash	malicious	Unknown	Browse

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report byte.mpsl.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/seats/.#seat0Fm52oR

/run/systemd/seats/.#seat0W0UBb9

/run/systemd/seats/.#seat0YfHRGW

/run/systemd/seats/.#seat0ZnCYb4

/run/systemd/seats/.#seat0efH5hy

/run/systemd/seats/.#seat0p0VMpb

/tmp/qemu-open.014B2x (deleted)

/tmp/qemu-open.05i4lz (deleted)

/tmp/qemu-open.0CXJdx (deleted)

/tmp/qemu-open.0Ixygz (deleted)

/tmp/qemu-open.0L60cx (deleted)

/tmp/qemu-open.0PmZhw (deleted)

/tmp/qemu-open.0TvYlA (deleted)

/tmp/qemu-open.0UDrix (deleted)

/tmp/qemu-open.0YopNx (deleted)

/tmp/qemu-open.0bslfy (deleted)

/tmp/qemu-open.0dVcow (deleted)

/tmp/qemu-open.0hEK4x (deleted)

/tmp/qemu-open.0iht5v (deleted)

/tmp/qemu-open.0nKAww (deleted)

/tmp/qemu-open.0s5Lpz (deleted)

/tmp/qemu-open.0tZPLx (deleted)

/tmp/qemu-open.0w0I2y (deleted)

/tmp/qemu-open.16UnAz (deleted)

/tmp/qemu-open.183bLx (deleted)

/tmp/qemu-open.1AZwnw (deleted)

/tmp/qemu-open.1ExDix (deleted)

/tmp/qemu-open.1NsyXw (deleted)

/tmp/qemu-open.1WD1Py (deleted)

/tmp/qemu-open.1YXZlz (deleted)

Linux Analysis Report
byte.mpsl.elf

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
asdffasdfasdfas.o-r.kr	byte.arm5.elf	Get hash	malicious	Okiru	Browse	154.216.18.116
asdffasdfasdfas.o-r.kr	byte.mips.elf	Get hash	malicious	Okiru	Browse	154.216.18.116

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4392978820660198
Encrypted:	false
SSDEEP:	3:F31HlAS30pRl/wS30phl//:F3ha
MD5:	39708CD63FEA5DFA79DBAE08384B2DDC
SHA1:	D82C078EB88721A9277098CDA3FF943C32BE519E
SHA-256:	4532D43A9578E1D03976FCC578013C036021FD0CCB42F8C1042C3FD7D5B5130F
SHA-512:	0AACE1A4D9C86C3EA3B2BE2B70A7E579D01DF8D6080F53912CFAF23AC845084A7705A32C1A4C79FF4AD46E364E72290F127347C757A6CACD665CA90AA08B79B0
Malicious:	false
Preview:	LPKSHHRH....................Z.J/.A.z..tH....................................Z.J/.A.z..tH........................................................................................................................................................

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	3048
Entropy (8bit):	4.7995509082654415
Encrypted:	false
SSDEEP:	48:TV3ucCm7pPOk1TEFIfNftDBj8h7FzuwVYm5mupkVTLkWYkB4JyhXXd1NLF8pyhXa:zqnAKw3FZJBHqPuCD1z
MD5:	26D608CE0D6DF35FF90CBA10DF992796
SHA1:	D1289B3D303F40C12B1C7447280570DF78906DD4
SHA-256:	A8B80E0E44490093130458B2CF38642651125043A92E47A59F8C7036A4232D8A
SHA-512:	03E25ADBDBC4F554FC0D5FD33B25B245A4DA71D05177CCEAFB3A62C060914F6B6F1F80FF7BD0948AEA199325785A41A5C749536023D4E30FC7D955A0786A18D9
Malicious:	false
Preview:	Oct 23 06:35:07 galassia kernel: [ 123.578262] blocking signal 9: 5440 -> 1.Oct 23 06:35:07 galassia kernel: [ 123.620483] blocking signal 9: 5440 -> 660.Oct 23 06:35:07 galassia kernel: [ 123.624248] New task spawned: old: (tgid 5812, tid 5812), new (tgid: 5814, tid: 5814).Oct 23 06:35:07 galassia kernel: [ 123.629455] blocking signal 9: 5440 -> 726.Oct 23 06:35:07 galassia kernel: [ 123.638739] blocking signal 9: 5440 -> 765.Oct 23 06:35:07 galassia kernel: [ 123.647893] blocking signal 9: 5440 -> 767.Oct 23 06:35:07 galassia kernel: [ 123.661217] blocking signal 9: 5440 -> 778.Oct 23 06:35:07 galassia kernel: [ 123.670636] blocking signal 9: 5440 -> 936.Oct 23 06:35:07 galassia kernel: [ 123.680468] blocking signal 9: 5440 -> 1410.Oct 23 06:35:07 galassia kernel: [ 123.689614] blocking signal 9: 5440 -> 1411.Oct 23 06:35:07 galassia kernel: [ 123.697501] blocking signal 9: 5440 -> 1805.Oct 23 06:35:07 galassia kernel: [ 123.703994] blocking signal 9: 5440 -> 2935.Oct 23

File type:	ELF 32-bit LSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.618684036090976
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	byte.mpsl.elf
File size:	101'700 bytes
MD5:	85005d41fbe2af79bdcb879bf576cdd0
SHA1:	9550cf3e0af79aaa42d7569241c04c125f743a55
SHA256:	a4414f00a4b4028851b6d838bac84edc0514b90d0acf2d373f8546ccbb0067bc
SHA512:	fb2c3e6ac40dba38351c71db0b94ef8725a1f33211f64a4fc678a4fd2410b400e22e1c777ce0794231fe163c9aadd7e3d9fca8f95dcc512fb94b6d2ed73d6bce
SSDEEP:	1536:PP+mE2skxZfOoCk5Yg6PbssqF0//o5/Qhptsl61d6q:PWmL2xDsb86Ys47
TLSH:	E0A31906BF610FFBD86FCC370AA91B0129CC651A22B53B367674C518F64B65B4AE3C64
File Content Preview:	.ELF....................`.@.4...........4. ...(...............@...@..y...y...............y...yE..yE......3..........Q.td...............................<l..'!......'.......................<H..'!...$.........9'.. ........................<...'!... ........N9

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	101140
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x14e10	0x0	0x6	AX	16
.fini	PROGBITS	0x414f30	0x14f30	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x414f90	0x14f90	0x2a10	0x0	0x2	A	16
.ctors	PROGBITS	0x4579a4	0x179a4	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x4579ac	0x179ac	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x4579b8	0x179b8	0xc	0x0	0x3	WA	4
.data	PROGBITS	0x4579d0	0x179d0	0xc38	0x0	0x3	WA	16
.got	PROGBITS	0x458610	0x18610	0x4a0	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x458ab0	0x18ab0	0x1c	0x0	0x10000003	WAp	4
.bss	NOBITS	0x458ad0	0x18ab0	0x22d0	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xa7a	0x18ab0	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x18ab0	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x179a0	0x179a0	5.6109	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x179a4	0x4579a4	0x4579a4	0x110c	0x33fc	4.4268	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 13:34:48.444441080 CEST	34834	53	192.168.2.13	8.8.8.8
Oct 23, 2024 13:34:48.451845884 CEST	53	34834	8.8.8.8	192.168.2.13
Oct 23, 2024 13:34:49.389234066 CEST	50014	53	192.168.2.13	8.8.8.8
Oct 23, 2024 13:34:49.397097111 CEST	53	50014	8.8.8.8	192.168.2.13

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Oct 23, 2024 13:34:55.539434910 CEST	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable
Oct 23, 2024 13:36:15.553988934 CEST	192.168.2.13	192.168.2.1	8279	(Port unreachable)	Destination Unreachable