Edit tour

Linux Analysis Report
vwkjebwi686.elf

Overview

General Information

Sample name:	vwkjebwi686.elf
Analysis ID:	1560609
MD5:	f687fbb52b0ece060e753101bea9e83f
SHA1:	11f5577b31b3045754f55cd247d1a905d36d0591
SHA256:	8ba62f525366d1870f0c4e64a68ad0562384019a632e2941ce24c17eed6721fd
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560609
Start date and time:	2024-11-22 01:57:08 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vwkjebwi686.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/149@80/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/vwkjebwi686.elf
PID:	6238
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

vwkjebwi686.elf (PID: 6238, Parent: 6160, MD5: f687fbb52b0ece060e753101bea9e83f) Arguments: /tmp/vwkjebwi686.elf

vwkjebwi686.elf New Fork (PID: 6239, Parent: 6238)

vwkjebwi686.elf New Fork (PID: 6240, Parent: 6239)

vwkjebwi686.elf New Fork (PID: 6397, Parent: 6240)

sh (PID: 6397, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6398, Parent: 6397)

ps (PID: 6398, Parent: 6397, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

vwkjebwi686.elf New Fork (PID: 6898, Parent: 6240)

sh (PID: 6898, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6899, Parent: 6898)

ps (PID: 6899, Parent: 6898, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6241, Parent: 1477)

sh (PID: 6241, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6241, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6246, Parent: 1)

systemd-hostnamed (PID: 6246, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6354, Parent: 1320)

Default (PID: 6354, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6396, Parent: 1320)

Default (PID: 6396, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6463, Parent: 1)

journalctl (PID: 6463, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6482, Parent: 1)

systemd-journald (PID: 6482, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6483, Parent: 1)

journalctl (PID: 6483, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6497, Parent: 1)

dbus-daemon (PID: 6497, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6500, Parent: 1860)

pulseaudio (PID: 6500, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6502, Parent: 1)

rsyslogd (PID: 6502, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6508, Parent: 1)

rtkit-daemon (PID: 6508, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6511, Parent: 1)

systemd-logind (PID: 6511, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6573, Parent: 1)

polkitd (PID: 6573, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6577, Parent: 1)

agetty (PID: 6577, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6579, Parent: 1320)

Default (PID: 6579, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6582, Parent: 1)

gpu-manager (PID: 6582, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6583, Parent: 6582)

sh (PID: 6583, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6584, Parent: 6583)

grep (PID: 6584, Parent: 6583, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6585, Parent: 6582)

sh (PID: 6585, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6586, Parent: 6585)

grep (PID: 6586, Parent: 6585, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6588, Parent: 6582)

sh (PID: 6588, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6593, Parent: 6582)

sh (PID: 6593, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6594, Parent: 6593)

grep (PID: 6594, Parent: 6593, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6595, Parent: 6582)

sh (PID: 6595, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

grep (PID: 6596, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6598, Parent: 6582)

sh (PID: 6598, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6599, Parent: 6598)

grep (PID: 6599, Parent: 6598, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6600, Parent: 6582)

sh (PID: 6600, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6601, Parent: 6600)

grep (PID: 6601, Parent: 6600, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6603, Parent: 6582)

sh (PID: 6603, Parent: 6582, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6604, Parent: 6603)

grep (PID: 6604, Parent: 6603, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gvfsd-fuse New Fork (PID: 6587, Parent: 2038)

fusermount (PID: 6587, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6605, Parent: 1)

generate-config (PID: 6605, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6606, Parent: 6605)

pkill (PID: 6606, Parent: 6605, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6609, Parent: 1)

gdm-wait-for-drm (PID: 6609, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6615, Parent: 1)

gdm3 (PID: 6615, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6618, Parent: 6615)

plymouth (PID: 6618, Parent: 6615, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6628, Parent: 6615)

gdm-session-worker (PID: 6628, Parent: 6615, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm3 New Fork (PID: 6629, Parent: 6615)

Default (PID: 6629, Parent: 6615, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6630, Parent: 6615)

Default (PID: 6630, Parent: 6615, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6619, Parent: 1)

accounts-daemon (PID: 6619, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6623, Parent: 6619)

language-validate (PID: 6623, Parent: 6619, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6624, Parent: 6623)

language-options (PID: 6624, Parent: 6623, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6625, Parent: 6624)

sh (PID: 6625, Parent: 6624, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6626, Parent: 6625)

locale (PID: 6626, Parent: 6625, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6627, Parent: 6625)

grep (PID: 6627, Parent: 6625, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6632, Parent: 1)

agetty (PID: 6632, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6633, Parent: 1)

rsyslogd (PID: 6633, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6639, Parent: 1)

dbus-daemon (PID: 6639, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6640, Parent: 1)

gpu-manager (PID: 6640, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6641, Parent: 6640)

sh (PID: 6641, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6642, Parent: 6641)

grep (PID: 6642, Parent: 6641, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6643, Parent: 6640)

sh (PID: 6643, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6644, Parent: 6643)

grep (PID: 6644, Parent: 6643, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6645, Parent: 6640)

sh (PID: 6645, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6646, Parent: 6645)

grep (PID: 6646, Parent: 6645, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6649, Parent: 6640)

sh (PID: 6649, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6650, Parent: 6649)

grep (PID: 6650, Parent: 6649, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6651, Parent: 6640)

sh (PID: 6651, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6652, Parent: 6651)

grep (PID: 6652, Parent: 6651, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6653, Parent: 6640)

sh (PID: 6653, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6654, Parent: 6653)

grep (PID: 6654, Parent: 6653, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6715, Parent: 6640)

sh (PID: 6715, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6716, Parent: 6715)

grep (PID: 6716, Parent: 6715, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6718, Parent: 6640)

sh (PID: 6718, Parent: 6640, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6719, Parent: 6718)

grep (PID: 6719, Parent: 6718, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6658, Parent: 1)

systemd-logind (PID: 6658, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6720, Parent: 1)

generate-config (PID: 6720, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6721, Parent: 6720)

pkill (PID: 6721, Parent: 6720, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6722, Parent: 1)

gdm-wait-for-drm (PID: 6722, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6726, Parent: 1)

rsyslogd (PID: 6726, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6731, Parent: 1)

dbus-daemon (PID: 6731, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6734, Parent: 1)

rsyslogd (PID: 6734, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6735, Parent: 1)

dbus-daemon (PID: 6735, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6743, Parent: 1)

journalctl (PID: 6743, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6744, Parent: 1)

systemd-journald (PID: 6744, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6747, Parent: 1)

systemd-logind (PID: 6747, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6805, Parent: 1)

dbus-daemon (PID: 6805, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6806, Parent: 1)

rsyslogd (PID: 6806, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6807, Parent: 1)

systemd-journald (PID: 6807, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6811, Parent: 1)

systemd-logind (PID: 6811, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6868, Parent: 1)

agetty (PID: 6868, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6869, Parent: 1)

gpu-manager (PID: 6869, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6874, Parent: 6869)

sh (PID: 6874, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6875, Parent: 6874)

grep (PID: 6875, Parent: 6874, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6877, Parent: 6869)

sh (PID: 6877, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6878, Parent: 6877)

grep (PID: 6878, Parent: 6877, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6885, Parent: 6869)

sh (PID: 6885, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6886, Parent: 6885)

grep (PID: 6886, Parent: 6885, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6887, Parent: 6869)

sh (PID: 6887, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6888, Parent: 6887)

grep (PID: 6888, Parent: 6887, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6889, Parent: 6869)

sh (PID: 6889, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6890, Parent: 6889)

grep (PID: 6890, Parent: 6889, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6892, Parent: 6869)

sh (PID: 6892, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6894, Parent: 6892)

grep (PID: 6894, Parent: 6892, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6896, Parent: 6869)

sh (PID: 6896, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6897, Parent: 6896)

grep (PID: 6897, Parent: 6896, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6900, Parent: 6869)

sh (PID: 6900, Parent: 6869, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6901, Parent: 6900)

grep (PID: 6901, Parent: 6900, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6870, Parent: 1)

dbus-daemon (PID: 6870, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6876, Parent: 1)

rsyslogd (PID: 6876, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6904, Parent: 1)

generate-config (PID: 6904, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6905, Parent: 6904)

pkill (PID: 6905, Parent: 6904, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6906, Parent: 1)

gdm-wait-for-drm (PID: 6906, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6911, Parent: 1)

gdm3 (PID: 6911, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6914, Parent: 6911)

plymouth (PID: 6914, Parent: 6911, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6930, Parent: 6911)

gdm-session-worker (PID: 6930, Parent: 6911, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6934, Parent: 6930)

gdm-wayland-session (PID: 6934, Parent: 6930, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6936, Parent: 6934)

dbus-daemon (PID: 6936, Parent: 6934, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6938, Parent: 6936)

dbus-daemon New Fork (PID: 6939, Parent: 6938)

false (PID: 6939, Parent: 6938, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6940, Parent: 6934)

dbus-run-session (PID: 6940, Parent: 6934, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6941, Parent: 6940)

dbus-daemon (PID: 6941, Parent: 6940, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6942, Parent: 6911)

Default (PID: 6942, Parent: 6911, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6943, Parent: 6911)

Default (PID: 6943, Parent: 6911, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6915, Parent: 1)

accounts-daemon (PID: 6915, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6919, Parent: 6915)

language-validate (PID: 6919, Parent: 6915, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6920, Parent: 6919)

language-options (PID: 6920, Parent: 6919, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6921, Parent: 6920)

sh (PID: 6921, Parent: 6920, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6922, Parent: 6921)

locale (PID: 6922, Parent: 6921, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6923, Parent: 6921)

grep (PID: 6923, Parent: 6921, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6926, Parent: 1)

polkitd (PID: 6926, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6958, Parent: 1)

systemd-journald (PID: 6958, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6959, Parent: 1)

agetty (PID: 6959, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6960, Parent: 1)

dbus-daemon (PID: 6960, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6963, Parent: 1)

systemd-logind (PID: 6963, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6968, Parent: 1860)

dbus-daemon (PID: 6968, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6985, Parent: 1)

rsyslogd (PID: 6985, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6988, Parent: 1)

dbus-daemon (PID: 6988, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7025, Parent: 1860)

pulseaudio (PID: 7025, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7029, Parent: 1)

gpu-manager (PID: 7029, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7031, Parent: 7029)

sh (PID: 7031, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7032, Parent: 7031)

grep (PID: 7032, Parent: 7031, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7033, Parent: 7029)

sh (PID: 7033, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7034, Parent: 7033)

grep (PID: 7034, Parent: 7033, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7035, Parent: 7029)

sh (PID: 7035, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7036, Parent: 7035)

grep (PID: 7036, Parent: 7035, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7037, Parent: 7029)

sh (PID: 7037, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7038, Parent: 7037)

grep (PID: 7038, Parent: 7037, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7041, Parent: 7029)

sh (PID: 7041, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7042, Parent: 7041)

grep (PID: 7042, Parent: 7041, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7047, Parent: 7029)

sh (PID: 7047, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7049, Parent: 7047)

grep (PID: 7049, Parent: 7047, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7055, Parent: 7029)

sh (PID: 7055, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7056, Parent: 7055)

grep (PID: 7056, Parent: 7055, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7057, Parent: 7029)

sh (PID: 7057, Parent: 7029, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7058, Parent: 7057)

grep (PID: 7058, Parent: 7057, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7040, Parent: 1)

rtkit-daemon (PID: 7040, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7046, Parent: 1)

polkitd (PID: 7046, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7059, Parent: 1)

generate-config (PID: 7059, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7060, Parent: 7059)

pkill (PID: 7060, Parent: 7059, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7065, Parent: 1)

gdm-wait-for-drm (PID: 7065, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7070, Parent: 1)

gdm3 (PID: 7070, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7073, Parent: 7070)

plymouth (PID: 7073, Parent: 7070, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7083, Parent: 7070)

gdm-session-worker (PID: 7083, Parent: 7070, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7091, Parent: 7083)

gdm-wayland-session (PID: 7091, Parent: 7083, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7095, Parent: 7091)

dbus-daemon (PID: 7095, Parent: 7091, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7098, Parent: 7095)

dbus-daemon New Fork (PID: 7099, Parent: 7098)

false (PID: 7099, Parent: 7098, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7100, Parent: 7091)

dbus-run-session (PID: 7100, Parent: 7091, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7101, Parent: 7100)

dbus-daemon (PID: 7101, Parent: 7100, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7102, Parent: 7070)

Default (PID: 7102, Parent: 7070, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7103, Parent: 7070)

Default (PID: 7103, Parent: 7070, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7074, Parent: 1)

accounts-daemon (PID: 7074, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7078, Parent: 7074)

language-validate (PID: 7078, Parent: 7074, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7079, Parent: 7078)

language-options (PID: 7079, Parent: 7078, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7080, Parent: 7079)

sh (PID: 7080, Parent: 7079, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7081, Parent: 7080)

locale (PID: 7081, Parent: 7080, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7082, Parent: 7080)

grep (PID: 7082, Parent: 7080, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7087, Parent: 1)

systemd (PID: 7087, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7092, Parent: 7087)

systemd New Fork (PID: 7093, Parent: 7092)

30-systemd-environment-d-generator (PID: 7093, Parent: 7092, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7104, Parent: 7087)

systemctl (PID: 7104, Parent: 7087, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7107, Parent: 7087)

pulseaudio (PID: 7107, Parent: 7087, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7110, Parent: 7087)

dbus-daemon (PID: 7110, Parent: 7087, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vwkjebwi686.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
vwkjebwi686.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17308:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1731c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17330:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17344:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17358:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1736c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1740c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
vwkjebwi686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x7a7f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
vwkjebwi686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x7a32:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
vwkjebwi686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0xa54d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0xa5ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
vwkjebwi686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
vwkjebwi686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xabe2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
vwkjebwi686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xff4e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6238.1.0000000008048000.0000000008062000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6238.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17290:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17308:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1731c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17330:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17344:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17358:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1736c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17380:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17394:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1740c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17420:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6238.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x7a7f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6238.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x7a32:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6238.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0xa54d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0xa5ed:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6238.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6238.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xabe2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6238.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xff4e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Process Memory Space: vwkjebwi686.elf PID: 6238	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: vwkjebwi686.elf PID: 6238	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x695:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6a9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6bd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6d1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6e5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x6f9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x70d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x721:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x735:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x749:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x75d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x771:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x785:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x799:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7ad:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7c1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7d5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7e9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7fd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x811:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x825:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6502)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6633)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6726)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6734)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6806)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6876)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6985)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6482)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6615)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6744)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6911)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6936)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6958)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7070)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7095)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7101)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7087)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.207.dr, syslog.121.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53836
Source: unknown	Network traffic detected: HTTP traffic on port 53836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Process Memory Space: vwkjebwi686.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4483, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4509, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6072, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6081, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6185, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6246, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6379, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6380, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6381, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6382, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6631, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6632, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6633, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6637, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6725, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6731, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6722, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6732, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6804, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6806, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6807, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6808, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6868, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6870, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6876, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6898, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6899, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6911, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6960, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6241, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4483, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 4509, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6072, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6081, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6185, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6246, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6379, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6380, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6381, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6382, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6631, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6632, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6633, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6637, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6725, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6731, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6722, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6732, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6804, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6806, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6807, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6808, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6868, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6870, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6876, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6898, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6899, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6911, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6240)	SIGKILL sent: pid: 6960, result: successful	Jump to behavior

Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Process Memory Space: vwkjebwi686.elf PID: 6238, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/149@80/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6497)	File: /proc/6497/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6587)	File: /proc/6587/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6639)	File: /proc/6639/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6731)	File: /proc/6731/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6735)	File: /proc/6735/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6805)	File: /proc/6805/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6870)	File: /proc/6870/mounts
Source: /usr/bin/dbus-daemon (PID: 6936)	File: /proc/6936/mounts
Source: /usr/bin/dbus-daemon (PID: 6968)	File: /proc/6968/mounts
Source: /usr/bin/dbus-daemon (PID: 6988)	File: /proc/6988/mounts
Source: /usr/bin/dbus-daemon (PID: 7095)	File: /proc/7095/mounts
Source: /usr/bin/dbus-daemon (PID: 7101)	File: /proc/7101/mounts
Source: /usr/bin/dbus-daemon (PID: 7110)	File: /proc/7110/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6241)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6241)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6246)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:75805R892rl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:75808lzI4Fm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76107sQXUnn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76111FLcd5l	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76116qn9grj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76346ya0IDm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76347pn0tUj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:764798fql2k	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76538eDXhCk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76616TFLFzl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76689ovlqKm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:76701WD9ONk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:77713qGsVok	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:767902uM0am	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:788622Mc0Sm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78863gVsXTm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78943XlBPwj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:79035EvuShl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:79116CwXGLl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:79277weTObn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78039rd8KKm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78136YfZ7Rk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78139pp682i	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78152LRnpgn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:781563Yx4dk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78275EN6BRm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	File: /run/systemd/journal/streams/.#9:78276RtiaPj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6511)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6511)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6511)	File: /run/systemd/seats/.#seat0INLiRw	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6573)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6658)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6658)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6658)	File: /run/systemd/seats/.#seat0CtUfBF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6747)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6747)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:810320NSycV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81034e7dxHU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81035ooTQBU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81036pXbsMV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81037ddTRZU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81051EpWHBW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:810570SiZxU	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:810584FoYKV	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81059GVUa1W	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81144cHgLtT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81158npBqpS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81256nyA36S	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:8130238cFzW	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:813043kNyxS	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:81344di7hGT	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	File: /run/systemd/journal/streams/.#9:813463KkV4S	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	File: /run/systemd/seats/.#seat0gtlnpe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	File: /run/systemd/users/.#1279ZAwce	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	File: /run/systemd/users/.#127Tzd99e	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	File: /run/systemd/seats/.#seat0Y4Q7Fe	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	File: /run/systemd/users/.#127utx87d	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	File: /run/systemd/users/.#127AB1owb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6811)	File: /run/systemd/users/.#127KqlFxd	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6934)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6915)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6915)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6926)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84032hJOpAi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:840338vqAGj
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84034YXuyTk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84035P5rKtl
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:840402kfq4k
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84053n0TTpk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84054K8v99j
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84055Dg5zhk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84056aJQHGl
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:840640vbASi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:840659ZC2pl
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84099C5nobj
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84121Zwpxoi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:834089DeN3i
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83410DW4OPi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83558aCy2hj
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83568JkLbvi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83570k7kwFm
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83715M056bk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83769Q7HLbk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83897Z209il
Source: /lib/systemd/systemd-logind (PID: 6963)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6963)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/seats/.#seat010LEGG
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/users/.#127U6yZxG
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/users/.#127KzR3vG
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/seats/.#seat0kQitGI
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/users/.#127KsuQ8F
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/users/.#127JDWiyG
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/users/.#127ECxQqH
Source: /lib/systemd/systemd-logind (PID: 6963)	File: /run/systemd/users/.#127OojKFI
Source: /usr/lib/policykit-1/polkitd (PID: 7046)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7091)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7074)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7074)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7087)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7093)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7110/stat
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7110/comm
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7110/cgroup
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7087/status
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7087/status
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7087/status
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7087/status
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7087/status
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7087/status
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7104/comm
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7104/cgroup
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7092/comm
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/1/environ
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/1/sched
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/1/comm
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7107/stat
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7107/cgroup
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7107/cgroup
Source: /lib/systemd/systemd (PID: 7087)	File opened: /proc/7107/comm
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6870/status
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6870/attr/current
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6808/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6808/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6930/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6930/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6911/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6811/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6934/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6915/cmdline
Source: /usr/bin/dbus-daemon (PID: 6870)	File opened: /proc/6926/cmdline
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/3088/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/232/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1699/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1335/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1334/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/2302/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/236/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/237/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/910/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/119/cmdline	Jump to behavior

Source: /tmp/vwkjebwi686.elf (PID: 6397)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6898)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6583)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6585)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6593)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6598)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6600)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6603)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6625)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6641)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6643)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6645)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6649)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6651)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6653)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6715)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6718)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6874)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6877)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6885)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6887)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6889)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6892)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6896)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6900)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6921)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7031)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7033)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7035)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7037)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7041)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7047)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7055)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7057)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7080)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6584)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6586)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6594)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6599)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6601)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6604)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6627)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6642)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6644)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6646)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6650)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6652)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6654)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6716)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6719)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6875)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6878)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6886)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6888)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6890)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6894)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6897)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6901)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6923)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7032)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7034)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7036)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7038)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7042)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7049)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7056)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7058)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7082)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6606)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6721)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6905)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7060)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6398)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6899)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7104)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6398)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6899)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6744)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6958)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6577)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6632)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6868)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6959)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6615)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6615)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6911)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6911)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6915)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6915)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7070)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7070)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7074)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7074)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6502)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6502)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6582)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6633)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6633)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6640)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6726)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6734)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6869)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6876)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6876)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6985)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6985)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7029)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/vwkjebwi686.elf (PID: 6239)

File: /tmp/vwkjebwi686.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6582)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6640)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6869)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 7029)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6398)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6899)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6500)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6606)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6721)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6905)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7025)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7060)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7107)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6246)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6482)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6500)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6502)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6577)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6582)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6632)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6633)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6640)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6726)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6734)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6744)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6806)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6807)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6868)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6869)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6876)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6930)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6958)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6959)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6985)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7025)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7029)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7083)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7107)	Queries kernel information via 'uname':

Source: syslog.293.dr	Binary or memory string: Nov 21 19:00:47 galassia kernel: [ 588.946431] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.41.dr	Binary or memory string: Nov 21 18:59:05 galassia kernel: [ 486.785710] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.41.dr	Binary or memory string: Nov 21 18:59:05 galassia kernel: [ 486.785667] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.293.dr	Binary or memory string: Nov 21 19:00:47 galassia kernel: [ 588.946408] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6619)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6915)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7074)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 6238, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 6238.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 6238, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vwkjebwi686.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
vwkjebwi686.elf	38%	Virustotal		Browse
vwkjebwi686.elf	100%	Avira	EXP/ELF.Mirai.Z.A
vwkjebwi686.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
ksdjwi.eye-network.ru	154.216.16.109	true	false	high
ksdjwi.eye-network.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.207.dr, syslog.121.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
154.216.16.109	ksdjwi.eye-network.ru	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	JnC2t6WhUf.elf	Get hash	malicious	Mirai	Browse
	mhmdm9Hb6i.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
154.216.16.109	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	jwwofba5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	arm7.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	arm5.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	arm6.nn-20241122-0008.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	ppc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	anarchy.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
ksdjwi.eye-network.ru	dwhdbg.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
ksdjwi.eye-network.ru	qkehusl.elf	Get hash	malicious	Mirai	Browse	154.216.16.109

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wnbw86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	jwwofba5.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	http://clearview-ps.inwise.net/page_11-21-2024_1	Get hash	malicious	Unknown	Browse	154.216.17.193
	http://bc1qlpk73pgj3dz02nq8d9kpdxk.org	Get hash	malicious	Unknown	Browse	154.216.17.193
	November Billing.html	Get hash	malicious	HTMLPhisher	Browse	154.216.17.193
	dlr.arm7.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.25
	dlr.mips.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.18.25
	Purchase Inquiry_002.exe	Get hash	malicious	Remcos	Browse	154.216.19.141
INIT7CH	jwwofba5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	kjsusa6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	anarchy.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	anarchy.arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
CANONICAL-ASGB	jwwofba5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	kjsusa6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Mozi.m.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	anarchy.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	anarchy.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6939/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/7099/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:mSVvn:mSF
MD5:	6297FA73B8D07366FAF759ADD473D404
SHA1:	9F6357E2048A40290A611588E2A12B8B6668FCC7
SHA-256:	982D3624F0468132E7C525FB86346809857A52FF36726E13C95B320B41C34F01
SHA-512:	EC24F86D425FFD23C9B683E4715E04FBE15B14FBB7C0A01B8EE7A8F71AA507B6C61AF0D637D7BCF5327B9006AC2ACC73C035724DF6F1E28067C4F8DC077972BA
Malicious:	false
Preview:	7070.

/run/systemd/journal/streams/.#9:75805R892rl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4976935795044595
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7gKYZWUqsMqjs7Lbr:SbFuFyLVIg1BG+f+M8UUqsZji4s
MD5:	63D06727F5B00E509AD75F5883225A51
SHA1:	BE2426BD439A9EBFA0CD61139A94E4A0783613E6
SHA-256:	C6DDB497AF275B0F508A81AEA56BE684EFAB03CC90D75E8BE5FEDC17D2AEF719
SHA-512:	8B3C3D74BE94B80169C3065591D0A1941D148B81492DF453DDE908BB202C1B5D0BD4A724B8EEF89DE09A259249418750FCAA064AE46A0C1C6811C264AADCA3CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=16b1e494dc2b4ae9bae80ed53100fe6f.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75808lzI4Fm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.513548317411589
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmo+EjlA1f1wYm68jsv:SbFuFyLVIg1BG+f+Mo7cNwYm5ji4s
MD5:	22CC10050AAAC0B400B584D7363DDE5C
SHA1:	033BE9B5F3FA02790B84EA592E7B0F07FE1EA2C8
SHA-256:	43E449A1C84536501E3C8025BAA224E52C121C075BFB89103CC28A00E177F784
SHA-512:	64243E5690CB6559B0028C9FE7C24D6C49E56A9F3656AFE19C414FAF18206DD0E4C1D3ECBDC8A1FB950F9B4B1E77047EB5D4A75A0E7CFF0CBA7C99FF68DDB63F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b124aada891e4c62bc66f8ff9026aef5.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76107sQXUnn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.38385706314729
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9lXrTgaWEErTnrqjx:SbFuFyLVIg1BG+f+MX7NWtrTn2josQu
MD5:	A02F1A53DDDC13001539CB05E316A536
SHA1:	ACBC739955C645C55DB7309741DDB8C0F3AA5AFD
SHA-256:	2005332D5A221537FC994DD2E331197BFEF602CC517E4F9F1FE2BBA571A63D48
SHA-512:	5091F0F6E148F8927122422DBBF8F29698F6C02465F08E485A204443BFEE53ADCE6322721AECF1F15936B22F86DDB1795B7C55A40D563B45E37F26382B1949B8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7adcd356a36946e0910354ae3c56a3b8.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76111FLcd5l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394376330519256
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7yDssu1glsjsmNz0/:SbFuFyLVIg1BG+f+MGwx1TjdCLKzK
MD5:	66782FE666C9FE379FF3E9F6B65004D9
SHA1:	704A3C066B8F5CD0F3EFA28436575FFFA3115C14
SHA-256:	2907F06C5E23E99F1109A466075E2588B5B298E71AADEC8DE6F29B5C0F669CFD
SHA-512:	60223FEBD80492F75DE16D9269D7C49EC6E0167AB1AC70DB2C3E459BAEAF7028F2078F3EAF87DBC813D3C8ED4A3B7C4111DDE33B7C5C94DC6FEDC11E5E7CC340
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=154dc3fd68f54e7dbbd378ecf4a81e93.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76116qn9grj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3586955963085465
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpqDAdq4DrUcMJs2jt:SbFuFyLVIg1BG+f+M4DAdqOrUbjtWL0
MD5:	112FD6BB45E4BFE24B868F725CBB3A95
SHA1:	9B24C88C3EE427FAEE810D3CDE9152ECA70D4087
SHA-256:	991496A93B0F4DEFDE9900A34AC03C9D326EB0C8E0BEBFE8D7126B8010180541
SHA-512:	909F2E10BBA962E52768717B47F0886F8500DC6D495E4F0EF59FA628B4A1999713A4F151D284FC3985E27637FFAB5FF79B360C2B771A590749D55D11ADE194B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cafc2a0e8af8475cbf8c218392a05974.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76346ya0IDm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.436821599430521
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr1M1HzJAuqjsjOdlE:SbFuFyLVIg1BG+f+MKZNATjNE
MD5:	9FE1D62D1777FC40674D9FCB05EDB214
SHA1:	69EB98995E1E9F5D2B8615C82CEF2A6A7B02AA01
SHA-256:	CDC7D1496BD6DF6B8CB7F160EC9C7BB9C0413ACB301B89D904E400B423903225
SHA-512:	D6DE034DA1C72F10AA41D926D07EE60E06D5EAF14A544EC5BBE5BB8BAE2F17192777F88309A59D80052DCB89F28FE57E118C0DFA3053AFE69208DF7B554D7D7E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a512a05b37dc436699dbdfe09c4552d4.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76347pn0tUj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.478443192539714
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvWqPdd0HL2lsjsicN:SbFuFyLVIg1BG+f+MOqPF2jZcHcljX+
MD5:	DAC943C2E32AB361790DCDE0FCDBFA23
SHA1:	E6C11DECC1DE02F68CCBFF9C2D219A55039A55C4
SHA-256:	D8DEAD20C3D7920195058BFAF433790D6BF140BBB5A31362FCD1918F4716A167
SHA-512:	2E81D2B7DD9986E5AB0254F9F2C029674FED02838912AC8267A53C9B4283C1244F20167EEE5AF734D5C930BD45A3E38A00AB5DD13410B91D203B151D6AD4F021
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eb359eb2590a412caf8a7355a802e4b1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:764798fql2k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.359484992082374
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr2hWAkRLisZjshKJg:SbFuFyLVIg1BG+f+Mqh+ljbVC
MD5:	FDA0DDEBAADB0676CE2B725D3076DC01
SHA1:	2DBD1FFB63DCCECF2AFD7F426AD973BA58ACC287
SHA-256:	CD8AAEDC5D3A671BE595DC59120FBB3E013F667FD423614DE5397257170CF086
SHA-512:	291F077C3E340A976999CB0220107C4477BF57BC07537C88BE749B9CA310C45DAC64BF187401D3C870D3453EB03BAA8D4EF0302C30863CE3A29FE66EF18D0844
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ade7742a0e7c4edfa1c764d48ec80c99.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76538eDXhCk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.368075008466281
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpOSAdD5A9M9N2jswK:SbFuFyLVIg1BG+f+MMSo5d9N2jLkGq
MD5:	75F54CF245C2BC91E346DAA7B7BFF640
SHA1:	D33798D401CF9A5AA2CE2715A3270007FEE23460
SHA-256:	16729A8EAA22D0720711D6B7E7536CB1C011AC6FD9EFA8A46EA4205293D7C0EB
SHA-512:	F8F757E092F383B646B5A41AE68CA1E181BBBB891009FA34A524E057109CE5B450B47CD8478D030B47114685101786B317ABD1121E216E554C88823EA16319DD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c7e6c28ee8ff48e9abafe5def10a522f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76616TFLFzl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.427810233756528
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyqGThsM9oIs22js2ALl:SbFuFyLVIg1BAf+Myq27fF2jNALyAZD
MD5:	C5394F87B57AA450ADB719DAF66E23EF
SHA1:	E47BF7152E0C0430E43544BF26FE9BFE28AE7C65
SHA-256:	68691E09C1A346557AB5D498028AD10F5BC039ABB5426111628C43D9C2FA009E
SHA-512:	69AB9A0FB38C46B3DFB0BB5857DA4A046DB0A5BC0299CFABBD00D463874AA84B43F36CC75854B5FEC67316E55BD27DABE71621A699B1C9DD67063CB9DB9F8E9C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=80ec6553e95a4d9a8c2a297f36dfad45.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76689ovlqKm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.458864162391639
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzoRGkArSC2Fsjs2BbQL:SbFuFyLVIg1BAf+MsUkAr92WjNdQIeXD
MD5:	91083A58C261C8EC99402FB9ECBD7679
SHA1:	D8D1F6E0EA3F5471CD6F9B6B266BD492DCCD56FF
SHA-256:	75F30F978A2D88635FB500035110CA1A305C6A549B3216A72607658AE0526F61
SHA-512:	09C19FC966FBA26749A7AB3A32713AF7E9BF5488327849003D5B829F486224A67A960A114839AC2E85D1327FC59F2D5262D56A72CF23384819CD5C69324FC650
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90f2d9441aa247ed84c5b6a1b8dd3d20.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76701WD9ONk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.432966150708473
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm70d3HLBcDUj2jsmNu:SbFuFyLVIg1BG+f+MAtHIjdCt/rRMtq
MD5:	5EA29E913B6EB16D536744ED94678198
SHA1:	F95F087D84DBE1C1DE52F3F3378C623A0432545A
SHA-256:	509BA460E27078E529E170DD05ABADDB224C076E9E0120EF6933CE8764F36C36
SHA-512:	A0D636A6EA4B1F8FA6CBF8B3486E1729D62563AAC6BCBA490B63552533F4B2775F65EE4C44940F3E0726BDA9E92134A77A2C8BAACE57BBB07FCBEFAEB99DE580
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=17bfdb2a6fba46008660d66f5e463f14.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:767902uM0am

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.427588739610654
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoCVBzOo+TjLTTIWTIL:qgFq6g10+f+MoCrMXEWEL
MD5:	C94C1FAB35AAD2766CFA5C11D8D8E64A
SHA1:	1B93D4752690277F1573243945CFA171E050DE06
SHA-256:	1F549EDDAF20133B3B65723A25BBD1F9E0DAC8353B2FC09E8C1C37289585FE3D
SHA-512:	92DAA77F8F0E15017B43F32DF7F073FAE2E434F4F4B98C810F9F3E2A48763882B9AA0473E8968385DAB52A35A622645F2C400C8BDE7C66F6C65A8EF4ED3128C3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b8e291dd07ab4c0284e70010dfb67f98.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77713qGsVok

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.372080004567037
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7cXA0bNsZjs2BZZGu:SbFuFyLVIg1BAf+M6A05sZjNTZD
MD5:	AAB6BB221515D7E318A7EA4C045D456F
SHA1:	6B36B4D352E1EE4EBAE8AFD4ECF1E9902CE29452
SHA-256:	27591B6C4A7720E0DC4C2D4D2B84EA97068E0408F192464456AC6564CA49D653
SHA-512:	1D2819E030B13086FCDB2F102433391C32B9F705FE53EB4A466C3F23395C8004A5488965436B809C24829591322CDB04A6BFB567C81474E5A7E12AC7C3508655
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e82223acec6475ca59152a161aeb006.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78039rd8KKm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.473755027420675
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm65HU7IzeZjsicWmIo:SbFuFyLVIg1BG+f+M6q7IKZjZcHcljX+
MD5:	EFB89F9C90800A9F0481073E7FFCA92E
SHA1:	B93B39CC712150F5E1DFA42BB77772BF9FFC354C
SHA-256:	93FC93FA17C7078A5CC1DF21867E9E908F7284A61394068244B2D8EE4C62119B
SHA-512:	2A42F6501F71D7728DB6C7EF8DF4BF5CA460D78223F2FE7A7763576C0EC55FE5B8D70DEA43858BF309D0EA2ACF6E0455B18E7AA552C5981E6C2DC10EA2317B3E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0bed5b1c13214147bb94fcc45cea46fd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78136YfZ7Rk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.430730129242657
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M4BwYbY9NZsZjNALyAZD:qgFq6g1af+M4BwQgZsnIZD
MD5:	258F1BF05D4C869E66D436EE18D5BF07
SHA1:	BE293A022D8460E39E450F33A5A527E7D04C0CBD
SHA-256:	B59A87468FCADC00F0B6F7E5DD92D956A627E0E4BC3D984E614BB113187C5EA7
SHA-512:	64DDB7EC0BE38654958EFC9A17B4E0892CB5575937E1A60445C1C6E1C07B20CE93C5F65AA16669141039B364524B01F8DDC7F893B87D658E43924D701D8E3D24
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2db503a49aeb4d08b0e7a380185c6f4d.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78139pp682i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.463345281289778
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8RVOdcWPVcQdEwsjs2y:SbFuFyLVIg1BAf+M8RVPWuHZjNdQIeXD
MD5:	C592C7D9F51DDCB65F37D2FDFB457561
SHA1:	9D3C13789EDDEA7CAFA1D24095D471541D6F3756
SHA-256:	194004509856903C32385C786FC861F275239E4B7A564B0BABD70D607AB86303
SHA-512:	877E6BA3B397EA565130F5A0A2ED4887DF3F6EF833510FD9BB39AF1F97C00A5343DB695D873D33754F7725810771C1018B370CF20347E1529612557D9FDA1E49
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=684468ad72ab489eba313091180f389c.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78152LRnpgn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.387117796844607
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoES3RwG5SC+D+sjst:SbFuFyLVIg1BG+f+Mo7hw+SpjdCLKzK
MD5:	540162156DA22C962D768B9DD174C34B
SHA1:	51C797BED12B2420FE8F98D895DA9B99599F4BCF
SHA-256:	BA601FF661768B9E6ABFBC0CF6EACD88F51E6AB05A87B878827ECFEF9F4CF16C
SHA-512:	27C3B8BFB4A4F89C7B2B4B7185094464D90E5769EB2E1341858E56CB5D0EF7D2786C7E04379D04BFFB3B722A22BB7025266575719AE27C33A992A76CD71B7428
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba645d5a921443cc9e5285f5f908eef3.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:781563Yx4dk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.374933841946017
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6awnQdiAVUcVYjosQu:qgFq6g10+f+MAnIiwFVGQu
MD5:	DC298AD3B8152A50144717552BF0A8C8
SHA1:	0AC8F45E59EF79895B0B3AA9EA0D6F6F99978314
SHA-256:	00F8154979B9A3A70BE3D0A03637374F5B72E4A14C93B997A4BD700DC36318CD
SHA-512:	3DF5D84BF39C21EF539F1780B7E6147CF5CEFC0D3ABDA8D53D816F5F89C7C3F4B87DA01C3A67EB6AD42DE21DEC7029A05DF51FF7421A0B1F21787D2797924281
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00e00a2effed432896f4f40270190fe7.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78275EN6BRm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4016859736386476
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpucBKlO2zuhuxsjsc:SbFuFyLVIg1BG+f+M8D3zuhTjosQu
MD5:	96292C2DF8C00BBFEC42B5B23D0F5FB4
SHA1:	8C8F5AA11BB60D912C0D9DEE9800BEC145878BB7
SHA-256:	BF032DF792040FCA1C5B5637CDC8EEE2B6A294CD91011625C31D81106FBE1A81
SHA-512:	28A9056EBBF7694707996234698FF3361267DBBD2DF4FB1D8F4E83D1964F175AAF0414767678DDFFA824E9B1A14AC51513113FFE051C2A46025E69723665AF53
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cab1152ca43a4d6cb205d2090f8430e2.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78276RtiaPj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4275198545076275
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuXXKXUkW2jdCLKzK:qgFq6g10+f+MAXKxXCLAK
MD5:	69380DBF36623D3333F7234AF9A6D514
SHA1:	3DE2C2F13EF15C941BDF556A24DDE89411205DB3
SHA-256:	5FC43849DCB18B18056821389D9DBAB915506945E26998D73092FEBC8B307F6C
SHA-512:	AA8A6B9E27899FE5F4FF1446C6B185DAEF4461FAFB4BACF186308FFB68BD154AA0987DC3AFB45570F9ABA45101B6CA1EEACF6D5E045E68CB10E4AAD76BD82E83
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d62d751d962c48219b3f3f8999843481.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:788622Mc0Sm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.423615470509929
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm90psJdwV02Hjs2q:SbFuFyLVK6g7/+BG+f+M+psJcnjNq
MD5:	01B559A0E30EE0CC55F783698770BDF6
SHA1:	E0DE4EB44F82EE281FEB887AC10CF5014AFDF635
SHA-256:	E209B9673DF85D95A9F08F0E7537BFA22292B29AA5B51176D733120D0E976CC4
SHA-512:	4DD9C953452E14C8333A20010DB4A5A667F1D83F5CB3296D2AB754067713E6E9201702B1B23B09F80B5417CA820D9E5E4BA7DD755FFE0C4E769235FED27AC6FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=74773f2ec5794843b108423200a8e7c7.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78863gVsXTm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.422888755381332
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzA8DXUBR3oogfHq:SbFuFyLVI6g7/+BG+f+MHDXagPZjNq
MD5:	BFD50F58247F4BBC8F8D538941B63439
SHA1:	60D09E80897D835F91A59B52B90AFEF97340E079
SHA-256:	B466DB250F145CF688E8882C89FF7BF995C241990389E8556DB956C2FC7D4304
SHA-512:	66AC02819D09F7319518BAD3635F4A8528211C68543FCD8A114D622984FBC5631F5C9A428D50E55E7EBCC54E95350B3AC6052E97565A27FCC11CBFADF15941A1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=927f03f21c434b218d30ea940ac915a5.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78943XlBPwj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.375535508771409
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MygxaE1XAOUHrjdCLKzK:qgFq6g10+f+MzxaNDtCLAK
MD5:	76551434F845EA4CBDF18F5BA0C55698
SHA1:	B2D9B9B8B3CD50CA3A032B4C62CBCA19F68A8923
SHA-256:	87FDEB50083BBF3FF0F0BA4F7871746CFCE6B8EC2664B60E466B64C6FA123E6E
SHA-512:	CF9A9A29FD2A7C9F798DBD5CD23F6FF8B3B3E9CCE6D5D55F3B71EA238BFE81014ACBBD261C339F6946FC36240573FF5596DDE1ADE6EFFF5DB38B3AD7E493F923
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8d6005151bbc4263ab028a28d71b5be7.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79035EvuShl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4159507585625954
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsWoaedGGa3Q2jLkGq:qgFq6g10+f+MsWt53oT
MD5:	058B45EFB2C1E31A09B8143DF0C1D269
SHA1:	71D9DD0323DB6AB8CA8619E456FC5E38C6E6E194
SHA-256:	C6629322650FB76B83F61EE036B713E64D90064098BD6798465E61AEC0D6E05B
SHA-512:	7F5E3DD5375FC9D9A3CECCC505B6530A246A4CA6A8CDFA55AB5E319E3CDBC27839D0BA52A86F8D5ACA2D7829D5F05DE865B30D39CB9403922E925E8A38112FB2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f3488e0af1074fa1acc429727b914564.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79116CwXGLl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.388501210752275
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MmxTQXu/WvsZjdCLKzK:qgFq6g10+f+MmxTB/VCLAK
MD5:	AECAE5C40A7946BA53DF8B70D0176F4F
SHA1:	FCB29430A9F0F16A6D084FA7CF37C3196E38FA10
SHA-256:	4D3D0966F665D9E122E57F43F0107A353416118E8B94AF5E55C469139FE09D7A
SHA-512:	346293EEBC63C1BF384B333AE86577A615E1CB6C788E279C978FCC4988FF525CB87F770E6507DBDC9BE0FDF3C7AA730D0D22BA58EE35BD20071B6687429AECC9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a027fb3f7a64265bdf887ef58663673.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79277weTObn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.406456626521
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoyBoIcUc/ATjs1Ha7:SbFuFyLVIg1BG+f+MoAdTjosQu
MD5:	54380D3B49948A5C2AFB6D112ECDDFA2
SHA1:	AD1E1A4E9588F19F91357109B0C9F1E140112FD5
SHA-256:	ECF349E8D59B48B4096D9FC6892B75D769A5E9811F0887BC05F115391310F73D
SHA-512:	D34491ECC2A8B0DBB7AA8402CE4D587407BF7AC4AC19E2EE5182F67DF72B5B99BB37EFA1DC72EF96F5EF48C4EBC8F510DA2BAA18DFA9918A773FDFBD91EFCE3B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b797be1e9bd0430fb25b95915978d187.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:810320NSycV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.500079539036476
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6HS/DRdvziY+sjs77:SbFuFyLVIg1BG+f+M6HSLRw0ji4s
MD5:	585548182BE8B766B650735274B2ADAE
SHA1:	233AA5668220CEDDA5433B4D1DDEB2CDF3F3E894
SHA-256:	5E3BC7C1B7479D346F83EABFCAC7584C13F3B9412EAA57A3B58FB0432929D1FA
SHA-512:	18F5F4582AAE613BDC068CB8C8F3BD97E8468C60E8B8C02BD42F27A56C528FDDF9009B7EC9947C935448979F8E8699FD0632BAFDE30ABA75D88E660D05801EA4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0dfcc95a0f4f4888bd4e832391893fca.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81034e7dxHU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.482887310851931
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoB2GX6h21wqjZcHcljX+:qgFq6g10+f+MoBjlWkmAu
MD5:	8E62E97017F4B41607634010C68B2BD3
SHA1:	A6E7377DF762DEC08EE9F6E032CE658F299E4B7F
SHA-256:	5F190B39CEF79B04E9379733BB7A771B1D82E2F776313E55532E31EFD1B575C5
SHA-512:	4D6E7E96FA5A585F741C2B262A80B4D22F903E69FE7976C0A3F9673E41BE53703512CBD558F00E3326D37E5767AD4ED690853C096D9030EA5EBD4A8FD1301103
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bdde5642e8be4df1bc00cb5174023691.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81035ooTQBU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.453082155286232
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5z3RTZtW/A+sjs1Ha:SbFuFyLVIg1BG+f+MRw8josQu
MD5:	C4F115A7355E7568717C74685EC10BBD
SHA1:	4A9C1E110AE91E214F3E9A06D8FB60FB475CDE26
SHA-256:	47678F6E477A9CCC78E162A8A05F63D9FAF893291B6AC75617F72D52F7B1BC61
SHA-512:	7DC5FE26D57873CC310B6DF155337740448B8478314248CEA408AF7682102C5934354880C6F2DBD5598CAFB8C8F69D08F410C00DC9692CB45B4B55ADD416C2A9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3da63dd468d64098a9145f7c56825271.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81036pXbsMV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.334995275191105
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyLheCRDN2jdCLKzK:qgFq6g10+f+M+heMqCLAK
MD5:	E1BEF7D0E15317FA45DD0450CAB2D8C7
SHA1:	9F833D69972C6863ABAF83D9626E2B80C0217576
SHA-256:	2712C9AEB95FF791DF329AE4474D40430A3E2B06270D95593316E719A61606D6
SHA-512:	8A7D2104A3E7CA763E0DCB32B693FDE5DCE6648E64A5E5BFD5A928080520EE0E6F971B213B43F7717A967C5F525B1E598949412AD5A9C2856547201D15847B64
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=86a72d30dad64efa8e80fc3fa73866d4.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81037ddTRZU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.512578533468473
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8aM6Fr2jZcHcljX+:qgFq6g10+f+M8xZmAu
MD5:	43C3B699F789FD4EF7E54CE4C7A26DCA
SHA1:	AF55FB4915B01CBC4CE71C431CBAFF55D27AA3CE
SHA-256:	A7B6F8AB38F1C69F225959D50A7A78AB6A51B7E19BDD10CE53DDBD515AD77EEC
SHA-512:	271FF5CA581EB5A8F4E59532222CFA31697390FDE76AA892758B72AC9E7A4EF26E9C7F2C84DCAD4D0F83AEC54EB2599CEDCCBBA9A8DDC22A46054C89C2B31941
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6952344c06884c0492a195f5c3bf8a65.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81051EpWHBW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.433556338957894
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7BP51pa0Zjs1Hadme:SbFuFyLVIg1BG+f+Ma0ZjosQu
MD5:	FD71E5C85BF8B1C7095E0CDF063104EA
SHA1:	12AE19019219DF9D8CA66C904B2FAAD343BBE6C9
SHA-256:	19D3207CB122BD6F2A7C9238CC7F67367D5CFD67B77E627ECEE31F302CC1CB81
SHA-512:	3279DFAABE3251FA35A60D2E7E73C29DDB051DBCC18AABAEE4F2D05E5070EE10275012DF2E5EAAE13B7660CD60C897376DD84A641794D9DB56FD00A1061BDB09
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=18f67d786fdd4a958f48951341ee713f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:810570SiZxU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.437135239123013
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmySlEKT4jswkClrTq:SbFuFyLVIg1BG+f+MySl9T4jLkGq
MD5:	812359646DD3EFA30FC16EBC30A351EF
SHA1:	4330291C5B6CC7934F5FC311354370AD46E06B83
SHA-256:	B4A7E79AFC8CA16C95F6831E23F2CE7E3E353175FE1EBCD6A9C4BBEDF717BA0F
SHA-512:	6A360CD9FEFD25D2FFAC0C618E533A9EC1E4517E4D73D30114F4AE88C99B4E07D98A60786A339A8823D8BB7B0284DFA97D35A21B7EA7241525DFE6D4B317E5D2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=833e573bbc9c4722af248e68dc0b697f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:810584FoYKV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.458902257627865
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+PJb2GWgE4sjs2ALAXA:SbFuFyLVIg1BAf+M+3WvjNALyAZD
MD5:	CA092C5C58519E6492C1C7A3762D9FF1
SHA1:	3AFA507E1872BB9CEDF894C3B6183C34029DC7AD
SHA-256:	31D2400D7E36C9006ED207B01E96485C5185C90006CBF117F6ADB79A765EA368
SHA-512:	D8303C9C2E16FEB653A9C610C7FBAC09057AEB7CAE9FAC01880489EDAFF3F6C724E392F0B94CC3A0F9EC0929D3049B13F1A8506973C99E89DCCAB7395CC24003
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=406466547f2b4ecf893809c3979a5e63.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81059GVUa1W

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.496107245566634
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoYRT/TReaBG+PO2js2y:SbFuFyLVIg1BAf+MoCReaB1jNdQIeXD
MD5:	E073FEAD73036594D57C4660E7E3B918
SHA1:	B268816DF817D5C969D65B629659E8627E27BC86
SHA-256:	74592CED0E872ED082E719EED2CFB6AB25A9A5F136E53EFC1EC542E566CC0917
SHA-512:	90944E6E35B2B83D2A5737A1C0802FCB2E73B17A2EFCDBEA79F3DA87388CDDE5FCF72762E4210504AEE0A5E0FCCE1AD5AE2BBC340E931E4191DE554BE25C0CD8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b724460eb03648938dca25311ee65f95.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81144cHgLtT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.408196039781574
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoXhUVf3R47H0h+sjs2R:SbFuFyLVIg1BAf+MoX+54AZjNTZD
MD5:	CD3CAC134173EC78D0A0CFEA280DA2E4
SHA1:	58D4BFFBA280673BB51699746FE89AC8394287E3
SHA-256:	A5BC95A99CEEEBE64D54855AD3C156A46EFCFEBC867BF0A71C5530AEDCA3EDF9
SHA-512:	9483893CA7C133B5F56CDB09D70F4308024832148F592C18C3461F84A8C7624CFE29FE1CD154B2B3FB198206916E80B35CC30F0BC93797484541CA327D24C778
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b589dbd2194a405faf57804ff7faca7b.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81158npBqpS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.461436064822225
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu9hOFdajHSDjLTTIWTIL:qgFq6g10+f+M9F+EEWEL
MD5:	903B11368C643D0E4AB390E2F4734766
SHA1:	F17C54C423A0D8357688D7A7E07A934C7C33CEE4
SHA-256:	0960FFAE3F3E26838196558C8BB6CC05F185430F984BD68083AEC04B7D234598
SHA-512:	93614336C325209D17180B4C01D3B3BEA747D213EDDE9C9675A348C49D27414579FA37067CD22CC91C401ABF35AD1F9ABE29A29D63724516F1CE210719F138FF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d264734bd1e544208fc60810c7454699.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81256nyA36S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.428468940619332
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmubWToTezrxsjshKJg:SbFuFyLVIg1BG+f+MubWsU2jbVC
MD5:	BD7300540D1D8059686D58CDE46A8AC0
SHA1:	96D18DD4EEE986B4F8CEEDE4DEB5967D0CF90C05
SHA-256:	700DAA4ABD446B75F6E10455E3CC3F4E7E239E7688B5C7A357DAA4D1ECFA42FB
SHA-512:	3923DE9BA3C3C72D74CA58CE42ACEFF8C5335C4C5D0872D6AC302775645372246011D35893D2253465C3A99E96D5B54C5053DA8674E466E18E32DDEBD55DB2B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc1b369b844f4c3d8c256a6245daf222.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:8130238cFzW

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.397347986194941
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MPPSVWHEGVHJMSjNq:qgFqo6g7/+0+f+MXSVWHvVppq
MD5:	1CFDFBB6639EEB9B0B164954FB17E201
SHA1:	C9788EDF0908A3C7E93A58C95DDAA3E897CE9533
SHA-256:	03B40EB9DD5BC9853BCC153F8AE17745055B9999326ECFAC19EB6057086DF4AC
SHA-512:	5AF1060937716D7E790E0EF9F550373997D4DAE508E97F9BD3C9473330AA0AADA4920EB63E19BC15F1F5706265723586A2D3B95744BEB3BEF39ECBDA91A4A79C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd4df673a42d481bac0ddb3a078fe009.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:813043kNyxS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.451870726942374
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7L94EGiEoUGd8sq:SbFuFyLVI6g7/+BG+f+MmEGoUGBjNq
MD5:	DB552B1E7BA1649895AD54B3918A1A21
SHA1:	76083679226C5BB1FEB10D9AF8DCA7FCC9F89683
SHA-256:	0CD789668507EEE56B333A70B78ABF028C46759AA9061C28B98B4DD75F48FAD1
SHA-512:	02326E2405829B448449C0A57B41177279900D9B61404701149E81AC4E6A29FDEBDC527AB3D839CEA1B0F03CE9F1F6C4142A15FE0D65560B447BC9347905F07D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e4663b8bf184dac96a15831322ac8b7.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81344di7hGT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.512747329916541
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MYK2SjFQMzKaBu:qgFqo6g7/+0+f+MYKXTmh
MD5:	7A33D5EF97C400C20253825C1036A4A5
SHA1:	B22347B48DF527CE607A5F756645EEBCADA3509B
SHA-256:	3B2B26C8468D3DD94C36999A01788CA7283DA19F81D7D2E75B01445F16A9C593
SHA-512:	C9E77BC1FD0D2BA6760AF49848767CB7CDA5559883A66DF9172A306705CCA0D31A0E000AF8F720EB1018DD04550D485D5D75A0314251F8BAEEF12722857F573C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5b9ffa59d25c4e7bad10de2810e635bd.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:813463KkV4S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.479443908679918
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mo/HEDQ2jFQMzKaBu:qgFqdg7/+0+f+MovqQETmh
MD5:	B8BE7F760EEA6A966EE557C1CE7F44E0
SHA1:	20716B7D719C8B4A74385D8C7351D8E40CC4B40C
SHA-256:	D506D1AC86C70A89DA4C9B2F290688BE60B10D2396B57BD1F20CAF1BD838E02E
SHA-512:	179FF018724C6205B09360BE503081AEEBEFB025BD232DBCCDC8A233C5D5B1B283C9BBDA71C5CF7C0BC749A6763D93AFE910E92707C40E7563D0C2B4EF888BA6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5e0a122aa8945c8859f58005deef10b.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:834089DeN3i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.451573180839074
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxms4XXj66OaBmCkup:SbFuFyLVK6g7/+BG+f+Ms4j66O3CYjNq
MD5:	4EBE1B798E5B4876BBB4E1B6C652F6D8
SHA1:	F6CAF7E55EEDD1621E8F672D4B294E57E28EFCA0
SHA-256:	C53EE12E686EA0E7143D536C6B756A943ABC61F706A0C242C6F5CD8EA26F6DB3
SHA-512:	154638B4305E2259A1AA342497229906D4F22303027A2E15AE7E51B778C82EA71B65F08844376F0E0FCDF3187D65128BC34A18E720A0A953EE2765DA5510750A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f682892b2b9943978afd121fdbc27c30.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:83410DW4OPi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.431060360326254
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzLodRQLBcUIWORz:SbFuFyLVI6g7/+BG+f+Mo7qqR0ZjNq
MD5:	7BCB7B339B99A66188C6D3959B8A2177
SHA1:	325F3E98427B0E56EE680BA699DD01040161E2B2
SHA-256:	AA249823FEDACA46CF23BC15F17CAE9BC5CBF881F3B331BA13A654AF7B37E27D
SHA-512:	309D7F7F8C59A32FC4A2748845C528FB8047C972837A50839DD6A0FF796C9FE224305B3287D14CCDE86BDBBBE13D5A270DC3C201F506B3DAE7DEDB48C39D32D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ad3c477868546dd91583e1192321694.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:83558aCy2hj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.434632756960425
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpvKDDsr8X3frqjsis:SbFuFyLVIg1BG+f+MEDDsc2jZcHBrt
MD5:	065FD967F2CDDE3FA9245991CDA464FF
SHA1:	52FCF59C5ED29B535C826EBFB634F755B04C2051
SHA-256:	F53C5D6E4729F2B228D9416E58A838642FE9C3882A73914D1DADAB2E4960790D
SHA-512:	3786DF493327C371BFD612057ECF1E05F57E78422F5C4B9492B0F10BC731C5537DADE1CE792FD040BA72D67742D875E11657AA92E5FD7C0F7FFED122CC014884
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cda8e4b01a1343ff99968d04c7032b28.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:83568JkLbvi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.526388149393841
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MB0wdWT2qo8jFQMzKaBu:qgFqo6g7/+0+f+MB0wcT2d2Tmh
MD5:	8D960D0FE8F6DED6CE9C2174CF677E66
SHA1:	C46A86645CA45E370B2BA31997083C395B5B8398
SHA-256:	F1A3B850893C7FEB6FFD7668AD635A11F34A196C40046CCAC44F0417FEAA5A59
SHA-512:	A0F78C8A2611E15C3DE11DF7A6EA2378DDEAF8138C170FC0030267828EAA03095CE6EF498BE408942C48C841C95CCAF310BE4CBC9A08037048C9677A1027D5DE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1555a17b0d174296b1d88df216829d93.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:83570k7kwFm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5181246375199855
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4CXeXViGF2jFQMzKaBu:qgFqdg7/+0+f+M4CqAGFETmh
MD5:	3D958EAF552BDA78C168214793A3DA02
SHA1:	3DF87FABBB57CDF843E9DA269E12EF8B1B6E7364
SHA-256:	FEA77E16BF8A8C1534B273B4F18A432614F4019B01C97C74A27712C124FDAD3C
SHA-512:	EAE36699900FAD2119EB39C2FE591D74BE2FF9ABD8C0750129175EAB5086A0558E9BFD4DCDF0A9014531649971DE46A1431384EBE89680ADAE884675827BFC44
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=20d6609d37b54ee48f24f3f0cf0d14b7.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:83715M056bk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.316714377638372
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpOSEcSaNfgyAD1F2e:SbFuFyLVIg1BG+f+McS1PRAxF2jZcHjv
MD5:	AE4A97D1F0AA4BF0592C713B2CC16C06
SHA1:	24953A07FD9D9FBC9DDAAA0BB7C53FD3B42EFEC9
SHA-256:	213DBE7FCDC6A763263290B80506D50E094F93839C654815B3025F56BA8C750B
SHA-512:	ECF3CC20C6F92CFF06422A2E22AD9A1C4819E2003D407A302F65CF0210F349107220E9743F027B31414F9D6CBC8C16EF812028ADB7B49AD2BBC465BC71243AF3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3a785a97ab0450a8c1f8f3b7ea58707.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:83769Q7HLbk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3661951151075735
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxms3AzoBSU9jQPgrqjt:SbFuFyLVIg1BG+f+MscoBl+jtWL0
MD5:	508D5BFA0C7A9954B4E6AAF1513289C5
SHA1:	DDAF2A39C1A488D6FF320EC72C4E766DE32014B4
SHA-256:	ACC3EDD8D8997B057FBBE57E94E9D1896ACE669E6051167726E95C8FBE22C7F7
SHA-512:	BCCD9F9B952F5BA0F5B83FDEFC83A6427AB003DBD1728F93FF3B6E607237DAA22A5B8A2C6A4596661D8E45AD4863AB558D19E60BEDD963D10B9A97574DF65A54
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f9ce40580d524809bf02ea3c2f11f778.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:83897Z209il

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.348409170795031
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4dP3R2RrUGGTAL2lQ:SbFuFyLVIg1BG+f+M4Vh2dHGTC22joa
MD5:	8E4829EA90B14E93CADDF00B4C9C4182
SHA1:	877923468E9A51814A055F7D3538D76E8DEE4366
SHA-256:	5E12335A7D7C636C4C964320F2DEB063CBADE37E4EC979503FB45360E5C01BDB
SHA-512:	622D698C93AE668F954C85C4F6B4C76DCC0415F9EACD230324F6948ECF520BE2BE0368619E7A75D76CD14414764A30A83DCFE0A682A54958925C421305E27D9D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=264a9159a0004de7b052d85d803c6501.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:84032hJOpAi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.438494957176794
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxms0AbMfendqjs1Had9:SbFuFyLVIg1BG+f+Ms0t1josQu
MD5:	F2F2423F3C791B8A89779287706D8636
SHA1:	1AE1CBF4D34B851E4B0CDF88329D37C3E94297AD
SHA-256:	04D1719296DDE2D8E17A6F368B49B068D0301B6EEBB4D02A61AB50F0DB4B696A
SHA-512:	1FE477857D10D637DA814798BB1E8ED7DBC4A76C9BE72BD74A6E51C0D88E03CCE632AF88DDBBD33EF3FF8DF114C137511BE8729FAA9C5FCE8C7C71F09B0FD1C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f43d3d2fbc8549e988003e9522231f16.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:840338vqAGj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.498209172292427
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9sOWDDnWT52jsicWg:SbFuFyLVIg1BG+f+M+dDnW8jZcHcljX+
MD5:	DA5A0B3F4AC250B86C574CB2E126D0B6
SHA1:	9489E46A01CD04D59E6CA1A3A9AE58AD9A4AB073
SHA-256:	1FFFAA83E10AE2C664691945E5F6EA0F60C784B5ED481BD8D5F11917D26004C0
SHA-512:	2D347DF53C01D44C8F5D1E33C14A618444294103194ACDDE6DC23E90CD3AEC09D34EA15EF8BEDB4BDBAC355CC1ED9EF19B86CAA76BEAC37D204203BE1C71DDAA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7e57dd0633ff4dfc8620b8b3934875cd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:84034YXuyTk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.380904987991202
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8IuvcSuRXXqjs1Han:SbFuFyLVIg1BG+f+M8Ix2joa
MD5:	604517026E79A62D086C03F752AADE99
SHA1:	85CBDE7DD0F4A36300DED6B9F7530CA94EAFBB89
SHA-256:	05A22961685ACCE7CF515249EE3309F89A4CB7BA4A39D77E920AC71B0B385503
SHA-512:	D3A0BBD41C24A527247F49447FBD25E034B7C80B826C29E44399A75F234FFFCE06DCF2EE26F83017231D4ECA59D8D0CFA9507360E56D85F1B737D2371F83BCD2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6585587d931e497da0f9c5908668c786.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:84035P5rKtl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.371392104311918
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmutgFi1PgBGVmgWUsS:SbFuFyLVIg1BG+f+MubECjW1jdCLKzK
MD5:	66962AACA3CFD88B237C2E3DD79782B8
SHA1:	1B4AEC9446E39CF32AB5246D597BB965E0A590CB
SHA-256:	A17AF559BA3DD2B448A631F86F50515AB6C7E43AC74A0B2A43B7F3AC11738410
SHA-512:	EFC5ADC7FDF335FD781B53C74C6FE951225027FF399E215BE68F8FD7FB65A72700298256B3153F66628EEFBA92C30DF07DB3E15EB8A5870A38D0B77736A1A0B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d471be2092ed4fbca96f76dc04e33c3a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:840402kfq4k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4281485347126575
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpkXVMflWNlsjs1Ha7:SbFuFyLVIg1BG+f+MqXVM9WN2josQu
MD5:	97C3C15BB23495117D3A7A112F4D8C41
SHA1:	FA99186E663F4852C3764D463B9D5034CE4E78BF
SHA-256:	32DAD5BBE15F56BB28B851B52939A0A65BD25567F0A4E2F665F861153F618C6C
SHA-512:	528BB253C9E66ADEE84B9C6A809B1A4A1DEDBF265C012B69C7864BA0E8A973BEE925AAE9E5D37E50EC3012CBFF51619817C60643DEF40AB8C5F3EBA5A8A01EA3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4187f8520ca417f8ceb3a5d74ce1d63.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:84053n0TTpk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.370741673470729
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm40Gcy096pxCYwsjsO:SbFuFyLVIg1BG+f+M40Gcn6hjtWL0
MD5:	166D8A6B1C770570967D4149C483440F
SHA1:	F8C9AE0BFBBB7436DF078061E3DCB2A5D07C768B
SHA-256:	FF569157A422EA06ABE67CCFC89A3EA110B5B9C91C5B67084E93B715556C06DD
SHA-512:	B03D00D275FF8304FAEAFDCB8F236AE70797CB411527DCF499CBD0F2215E31617094FC78D2DCABFD5EBC95DBBD73F482550E681B370A76FB29BB1C44D23A6CF2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=27bc655a638f4e4b805c768fb51a40a1.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:84054K8v99j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.445275768915442
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8BHIpIdjTiDZHXYgr:SbFuFyLVIg1BG+f+M8BomAHXYg2jNE
MD5:	16AF08E1090F86CEF7BB1C7B8560AC6B
SHA1:	7BF0B10B4DA82F48C456523851B634796A766586
SHA-256:	2F4FCDED93C62C316BEBAE70F97F88F9B7AEBD67EEA6D74F3B814EE96A858398
SHA-512:	EF52DCE5B45925FAD3733B756E641039FCD956A5C6AEFD89BE43BF01093482BA20A9746FBC20C82EE3800C5E9B955EE92817AEF800DFB1C51EAA7089F11E589B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6db8d1e6879c4916a8bf6913b31f60b2.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:84055Dg5zhk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.360098148272973
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+bAWGRilRSBzvsh+N:SbFuFyLVIg1BG+f+M+kWkQ0d0ZjbVC
MD5:	F85D8ED215038434F4833D8FB6039773
SHA1:	58C94C805E2C2B7FDB803567DEF0406FA0D8899F
SHA-256:	BA0C07D054927CE079F85A1117BCA28699F2A87C2DBAEBE5BDBBBE25477F5850
SHA-512:	AC7052B1DE974E58890717EBE58190D8A126F846A846D11A4551192443FE8726BD032952A5BC8D51F065D1A1B9954A665DA0985DF814D47A52B1A682D0E0BC22
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4fbe3c5aed03470d8cc5454f47dced51.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:84056aJQHGl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394286155549729
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmycGTbhURcLGBQ22j+:SbFuFyLVIg1BG+f+MycQhU6LwZ2jLkGq
MD5:	119648A98A6E8E90D28785EFF78D6D3F
SHA1:	DB10CB35958C8DDE8C666F72DD5CF7284B486B62
SHA-256:	C4FFE07D2124FDF8EE506D6E01AB71BBA50660386EF1836D3089CB07D477BEA3
SHA-512:	E788B4FEF8F1B81C915777A6FE69DA8F84D9E2D24862DA8DA357D39365E699A60F85656944B14ABF7FE4E3FB2A6504C66383284C90CBC520028148ED655AD153
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=865c656d99514923b168ded05bca5666.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:840640vbASi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.427045324599804
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MsLFMPqzF2jNALyAZD:qgFq6g1af+MsLFlz+IZD
MD5:	E17246FD32B5C923F2A9374EA51FFA0F
SHA1:	250444A3296CF77DB4745257A495A421AAB38DF8
SHA-256:	D2F80FC305F323F65065A4DD98B6052A3B249A35D5C0014A49B886ECB6EFEBCC
SHA-512:	B42F1ACE30380204E8C96DA16AC01B375CD2E0BE1E50A050FB1640143B7B8ACA50EF906BBB55A41D75F5A86E725358AEEB7AD3427711DD480C5C5901ECDF57D3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f412b9bf66464edf80a4aad7d94711b9.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:840659ZC2pl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.437385162507092
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/wU1qMeT9/Tghsjs2BI:SbFuFyLVIg1BAf+Moy69s6jNdQIeXD
MD5:	60B8D641DB95871111FCD86D5A1EB405
SHA1:	51B60E1DAAC7928E3AB02726A9BF7670BE2E3D19
SHA-256:	504844AA845AE6E4CA5C92AFB56971E7DEA2E8C11CBC59D8FFC974B4DB47B5B4
SHA-512:	D4FD9DD50F71283462C8B7EEFA995DEF0C47547CB62DB86B639ED5CBE94373568824AA398C7DDD297DDD18F0B2272564B115D0DB651D3AA0B7754EA9093DEA23
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5e017c0e6eab46088d8d89696a8c145a.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84099C5nobj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.390966562757056
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7a92wWWTHNMxsjs2BZd:SbFuFyLVIg1BAf+MOswWWDjNTZD
MD5:	D217ED1D041776504670FE36D3212DFD
SHA1:	96918F5DFCEDD4D2A283852B88B2D7FA98E7281C
SHA-256:	617880D6EFB60F2619C85FF02AB7592465725C950A362FF5EA71E98203EA5ABF
SHA-512:	D6172E847EDF1EA0623BAEF2D7791025CEC9BE1DCFE7BF15AA9F1C3EC268C95D1E5E6933237E4BAFFFC26446279588175FA8879AFDDD3A410C78F6D0EEC5866F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1332972f33df4709b5b0cef01cc36bc0.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:84121Zwpxoi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.400665710720131
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6FHBNiv7pswsjswxM:SbFuFyLVIg1BG+f+M69boCZjLTTIWTIL
MD5:	5D26CEAD513479F13416C29756C42055
SHA1:	32039B19B31E4CDB4DF2B029D1E4D6EB434BB956
SHA-256:	E5964E305BE3F7419489D33700864F808B1CD9EE5B592678989E7F8E6619B0AB
SHA-512:	FB19D45E2E4741BAFA62F0E288D7153BF9B29DB88947EA3E1A43C23B1E3BE5CC36990311B22B64C17E9B9A6EF5B39B31E5957DC53A88BAE31A1EFD83DE6AAA4B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=019b6b29a4b04c19b59995c5575cbedb.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/seats/.#seat010LEGG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0CtUfBF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0INLiRw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Y4Q7Fe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0gtlnpe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0kQitGI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1279ZAwce

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127AB1owb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.309388451876952
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgHuu41ETdvpk2xi206qodpvFS2:SbFuFyL3BVgdL87iesnAiRJgHuKvp5iG
MD5:	3D2573FAE7E0BBC688B3F42E946D611C
SHA1:	E9C367FE93DB800B8FD17C145046B7F62007C3A5
SHA-256:	C205EDD7E44F4625FE46751F2E7F387DDFB4E076995CC2B1F73E89E95F04D27E
SHA-512:	273EE37532F1091D8B824B05E801528BDDDB75F5BC1C92A56C9E810C93E7D41ECCD9D79D7C02405B496756F9B1ED71B64F0FFD4B58F6673DBB96E7439B28311F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1732237186592165.MONOTONIC=527809168.LAST_SESSION_TIMESTAMP=527919301.

/run/systemd/users/.#127ECxQqH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.471210035263057
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8I0JgHILt6Ln:qgFq30dABibBEICgHiILn
MD5:	CC4C9BA81BD33577BD40ED9114B7CA78
SHA1:	95DD1783444D337FEB69FF46AB295E1ECFD811D9
SHA-256:	A371213078769047ADF2EF232EF62919ED29954F62E637041752E8E1B185B959
SHA-512:	74C729F68E7B361CEEB3EAC4335ABAD20F6C2C1EF23B13BFFF87CFDD41C76ADCD4815D72078AD6DE406878BAA6132BCDF9CB41B9CC1FAEC3CBA23497551BC29C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14864.REALTIME=1732237243191449.MONOTONIC=584408452.LAST_SESSION_TIMESTAMP=584584869.

/run/systemd/users/.#127JDWiyG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.318305802361396
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgHt/e39/9H206qodj0en:SbFuFyL3BVgdL87iesnAiRJgHILt6Ln
MD5:	D30BACA68ADDB6B4B7D30F909E7DF214
SHA1:	A935850E1091AA4DB9C9A304143D4547E4749789
SHA-256:	CB39C28685BC9C061B41B21202F98A899FEA0B8FFDF55A1A9B5C66776D0B19BE
SHA-512:	7F9FFBB1809D721429C013C8E379F6B8FD68DE7D0147140641B0EFEF81833CF05DBCB5F36FF83A1696C0E2D1749BB6DB0A70797B9149F2773592A1BD8075C70A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1732237243191449.MONOTONIC=584408452.LAST_SESSION_TIMESTAMP=584584869.

/run/systemd/users/.#127KqlFxd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.468824075731041
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8XJgHuKvp5it6H0Uv:qgFq30dABibBEXJgHnvp5iI9
MD5:	939B549316F6A6F37A2B0D4E72D4CFF9
SHA1:	66AA1CD30BF45C3FB2B5B087D7CE20BD8FF0524B
SHA-256:	E163958D5B51F4A34026E5EB06F10614519E5450EC78B23472A1247798A9DCE6
SHA-512:	6C5871FCD8877CD2BFC8FC0AC5C9D52B77FBE94AC00BEFE9EFACA472E841D4C6EA17ADA69786CA527F3D071F2908B7FAF2CBFDEB98BD736BC232AD4EA8692802
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14127.REALTIME=1732237186592165.MONOTONIC=527809168.LAST_SESSION_TIMESTAMP=527919301.

/run/systemd/users/.#127KsuQ8F

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2927445699323
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8TgHIfQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBETgH+jthQHtPYq9M
MD5:	8350329577EA213462A9CC0D9F2C6C11
SHA1:	4955183D971CCEF006F00A62D4AC9EA7F12BA39B
SHA-256:	121BF183125F907522B00793591E02E7BB0F095D3C549CE3C5E4E16F2126F980
SHA-512:	1AD637A876D3743061445575F5F621A18887E6F70DEACA97C1BB2854A852030AA1021775D359DC08D0C98FE7D5496876503F7D89C6C6014C98F9B992E5B08A16
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14802.REALTIME=1732237243191449.MONOTONIC=584408452.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127KzR3vG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2927445699323
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8TgHIfQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBETgH+jthQHtPYq9M
MD5:	8350329577EA213462A9CC0D9F2C6C11
SHA1:	4955183D971CCEF006F00A62D4AC9EA7F12BA39B
SHA-256:	121BF183125F907522B00793591E02E7BB0F095D3C549CE3C5E4E16F2126F980
SHA-512:	1AD637A876D3743061445575F5F621A18887E6F70DEACA97C1BB2854A852030AA1021775D359DC08D0C98FE7D5496876503F7D89C6C6014C98F9B992E5B08A16
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14802.REALTIME=1732237243191449.MONOTONIC=584408452.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127OojKFI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.471210035263057
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8I0JgHILt6Ln:qgFq30dABibBEICgHiILn
MD5:	CC4C9BA81BD33577BD40ED9114B7CA78
SHA1:	95DD1783444D337FEB69FF46AB295E1ECFD811D9
SHA-256:	A371213078769047ADF2EF232EF62919ED29954F62E637041752E8E1B185B959
SHA-512:	74C729F68E7B361CEEB3EAC4335ABAD20F6C2C1EF23B13BFFF87CFDD41C76ADCD4815D72078AD6DE406878BAA6132BCDF9CB41B9CC1FAEC3CBA23497551BC29C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14864.REALTIME=1732237243191449.MONOTONIC=584408452.LAST_SESSION_TIMESTAMP=584584869.

/run/systemd/users/.#127Tzd99e

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.308815736512582
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8IJgHuKvxf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEIJgHnvkthQHtPYqi
MD5:	104CBF5D3C1C15EB5C839F47B3FCB060
SHA1:	51C8AAF4BE763820BD102579068AF7A6D0310AF0
SHA-256:	FA80B5F8BC9E880438177816CFADB884DC8BE16056617093671258202028FE19
SHA-512:	F79163DEB3E5249182308D5577AF2E761AE08834955BA91737CDF6D2E23F9666E1C98E587C69B68FFBE0D526AB629BD744E0FD993C71A0F94432AF3C208ACEBE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14065.REALTIME=1732237186592165.MONOTONIC=527809168.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127U6yZxG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127utx87d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.308815736512582
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8IJgHuKvxf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEIJgHnvkthQHtPYqi
MD5:	104CBF5D3C1C15EB5C839F47B3FCB060
SHA1:	51C8AAF4BE763820BD102579068AF7A6D0310AF0
SHA-256:	FA80B5F8BC9E880438177816CFADB884DC8BE16056617093671258202028FE19
SHA-512:	F79163DEB3E5249182308D5577AF2E761AE08834955BA91737CDF6D2E23F9666E1C98E587C69B68FFBE0D526AB629BD744E0FD993C71A0F94432AF3C208ACEBE
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14065.REALTIME=1732237186592165.MONOTONIC=527809168.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mX6n:mKn
MD5:	38B30F55E5778C4ABAC37D31D1BAC3B8
SHA1:	6F1ABBB259C3253D835BE5CBE72A65958186736E
SHA-256:	1741132A5C1A6A9F94FDA91E2477072BD445A05EADC267A0FC6BCDA882067375
SHA-512:	5DD6C7A6C689820B732F4F59F99FAC17AA01669471E1D2E0050A81662EE8E677635CD9CB9ED5903521F0DA4ADF7620A99D08869B3769C1B99201CCD754F94447
Malicious:	false
Preview:	7025.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:n4v:i
MD5:	3070FC8970E4BCDA32BEA745B5B5745F
SHA1:	5FF80168E53CDC9D201054D0B1E25EADF47C1096
SHA-256:	61256155E53B31498B4141BA3C4AB76C1CE38D5DDC187C40840D9DCB3FF19303
SHA-512:	30B324A174040687216DAEE09921DA3FE9B4640F957C5DB5564D702506E60FDA761CFA5ECF56CB275C5224D67D0A194D8778239078D83173FA5B96A7480CBD39
Malicious:	false
Preview:	7107.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:HCsXlXEWtl/Rlx:Hf+ylpl
MD5:	62CC9902756DE8C0AD03FC8DEB719F27
SHA1:	6C856844386AD20358639E81587EABA320C2CC7E
SHA-256:	BDCEEFBD55AAA0DE98E16A5E3A04AE34C93544E10795D253B9A8552CEFBD991A
SHA-512:	8FEA2152B38AA48776DD2683B0C368FC1F33F26C9CADDC17CA0453A50D8A9E94DC1756A9E9207CBA7F612491A9EE85F886CD2051861B966F344011F1384420E4
Malicious:	false
Preview:	..../...tty2.tty2.......................tty2LOGIN.............................................................................................................................................................................................................................................................................................../.....?g........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nun:un
MD5:	F285506BFE4DCDE524264DEDECD4E3A1
SHA1:	988D9CB1F6A8631081EF4DFAF3EA5E0E4DB17D4F
SHA-256:	4D248B9A78E1CF3EAFC837E1D1D3926D2B1CD398F451173F13857588788E689B
SHA-512:	F432FF87B9512D6CE6ABDBB057334C632B5355D07FB2F2684FDD4D5E7EEC52EFAE043C93B25289300961BDDA62EB427CAD8E7C69E46E04E3BD05C6350A64F695
Malicious:	false
Preview:	7110.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n7v:7v
MD5:	3AC9E3DA038283776549198B57EFA2A0
SHA1:	ACD34DFCADBB345912CF931AC7128B7C55A48765
SHA-256:	5931A5498991D828F9E26015032AF3849B757E01C28D940B306673A6B8F56ABB
SHA-512:	8A14273AEEDD03521379C6594226FC316C93083C7DFE4B73CE26C0F4825069496DEB56637C206064048C2BBC2C265544A5D07D7F13E9CB3CA9BE1327B97F10F0
Malicious:	false
Preview:	7104.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	1.9709505944546688
Encrypted:	false
SSDEEP:	3:mdcmfv:m6Y
MD5:	101B7502D0F38F3A16219A4C45EC1EF6
SHA1:	5DF82F9E0B92CC7B4C88F6FB064D68F89A5B6F17
SHA-256:	3AD0EF30992E837B0CEB279F5C1EB034EB9B5943130BBB1DBCFC0238E4C8CCBF
SHA-512:	1015111ED2F5BD3D9B98388A1F19FDE39C3C8B37D0CFCDC2010975AA909C8D332CB0C3C218758183CD3B2B2A078B019626EAF9C7890BD7E169551A90B9B02107
Malicious:	false
Preview:	7087.7088.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:n4v:i
MD5:	3070FC8970E4BCDA32BEA745B5B5745F
SHA1:	5FF80168E53CDC9D201054D0B1E25EADF47C1096
SHA-256:	61256155E53B31498B4141BA3C4AB76C1CE38D5DDC187C40840D9DCB3FF19303
SHA-512:	30B324A174040687216DAEE09921DA3FE9B4640F957C5DB5564D702506E60FDA761CFA5ECF56CB275C5224D67D0A194D8778239078D83173FA5B96A7480CBD39
Malicious:	false
Preview:	7107.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nun:un
MD5:	F285506BFE4DCDE524264DEDECD4E3A1
SHA1:	988D9CB1F6A8631081EF4DFAF3EA5E0E4DB17D4F
SHA-256:	4D248B9A78E1CF3EAFC837E1D1D3926D2B1CD398F451173F13857588788E689B
SHA-512:	F432FF87B9512D6CE6ABDBB057334C632B5355D07FB2F2684FDD4D5E7EEC52EFAE043C93B25289300961BDDA62EB427CAD8E7C69E46E04E3BD05C6350A64F695
Malicious:	false
Preview:	7110.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n7v:7v
MD5:	3AC9E3DA038283776549198B57EFA2A0
SHA1:	ACD34DFCADBB345912CF931AC7128B7C55A48765
SHA-256:	5931A5498991D828F9E26015032AF3849B757E01C28D940B306673A6B8F56ABB
SHA-512:	8A14273AEEDD03521379C6594226FC316C93083C7DFE4B73CE26C0F4825069496DEB56637C206064048C2BBC2C265544A5D07D7F13E9CB3CA9BE1327B97F10F0
Malicious:	false
Preview:	7104.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	1.9709505944546688
Encrypted:	false
SSDEEP:	3:mdcmfv:m6Y
MD5:	101B7502D0F38F3A16219A4C45EC1EF6
SHA1:	5DF82F9E0B92CC7B4C88F6FB064D68F89A5B6F17
SHA-256:	3AD0EF30992E837B0CEB279F5C1EB034EB9B5943130BBB1DBCFC0238E4C8CCBF
SHA-512:	1015111ED2F5BD3D9B98388A1F19FDE39C3C8B37D0CFCDC2010975AA909C8D332CB0C3C218758183CD3B2B2A078B019626EAF9C7890BD7E169551A90B9B02107
Malicious:	false
Preview:	7087.7088.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:n4v:i
MD5:	3070FC8970E4BCDA32BEA745B5B5745F
SHA1:	5FF80168E53CDC9D201054D0B1E25EADF47C1096
SHA-256:	61256155E53B31498B4141BA3C4AB76C1CE38D5DDC187C40840D9DCB3FF19303
SHA-512:	30B324A174040687216DAEE09921DA3FE9B4640F957C5DB5564D702506E60FDA761CFA5ECF56CB275C5224D67D0A194D8778239078D83173FA5B96A7480CBD39
Malicious:	false
Preview:	7107.

/var/lib/AccountsService/users/gdm.FOFIX2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.M3R7W2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.9115216501847865
Encrypted:	false
SSDEEP:	24:/z0ZeEDzWgDzOrzPLyzlAv6yzlA2+Vpz05yK25yK60pYrD5yKUI5yKCJrD5ftwro:/Wr0fy+v6y+fVp45O5tYrD5p5crD5f2U
MD5:	735D15E9D592B961C8F76769144EB582
SHA1:	2595BEA64BB14FC791021C568D434E1E2208A53F
SHA-256:	81A43863B4DB55A369E8D81D8FB39DA7B5B3390A83651C7DA95CA8091B37D858
SHA-512:	4BE3B096F5DAE326F15C2638DDAC6FE2F0BF7E2D0F689257953E755F8706A44D045E05664E648CAF6549F3945F3E8A5404C4BF5B8CB78308F310180FF81BE28A
Malicious:	false
Preview:	Nov 21 19:00:29 galassia systemd-logind[6963]: Failed to add user by file name 1000, ignoring: Invalid argument.Nov 21 19:00:29 galassia systemd-logind[6963]: User enumeration failed: Invalid argument.Nov 21 19:00:29 galassia systemd-logind[6963]: User of session 2 not known..Nov 21 19:00:29 galassia systemd-logind[6963]: Session enumeration failed: No such file or directory.Nov 21 19:00:29 galassia systemd-logind[6963]: Watching system buttons on /dev/input/event0 (Power Button).Nov 21 19:00:29 galassia systemd-logind[6963]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Nov 21 19:00:29 galassia systemd-logind[6963]: New seat seat0..Nov 21 19:00:43 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Nov 21 19:00:43 galassia systemd-logind[6963]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Nov 21 19:00:43 galassia systemd: pam_unix(systemd-user:session):

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hl5KKiU1O/KKiU1u/:F3JiUQziUg
MD5:	00BB3B81C569E814B97F857081051EB8
SHA1:	862011EEC467F27607B471D7653A753A5B07CCE5
SHA-256:	F6AC045A2DE0179A26B4B2A6587FEC268556C3369292E635A7546BDDBB9AE752
SHA-512:	99A37D57CADCC25F41501DEED7220C267B85A3C7A2EC623B73FC030844BC36F1705440B0E5D0529F6E889006E09E785A775F74A71DB2F4E126B76AF71DCF5136
Malicious:	false
Preview:	LPKSHHRH.................q...B...]...._.................................q...B...]...._........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4480473215248109
Encrypted:	false
SSDEEP:	3:F31HlBrFl82rFl8Klll/:F3R/l
MD5:	4D7439D7717FD3A027C73F48327C5616
SHA1:	72B15744B3140047BE5D178D6E89A1FDD217F1E8
SHA-256:	8CF48B356F8A8422A4B6176E5F11E82828AD6DFC27F10F350D5470C81F728091
SHA-512:	41A01578579BC958736A11F287CC010D0D643A7AD8BB426A714C653CB19B22A13FC969493279544425CFE8B17B2DBF57AB9B51C353BA9A082AE2BFC060344235
Malicious:	false
Preview:	LPKSHHRH................b4....O\|.....iW.................................b4....O\|.....iW.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12391
Entropy (8bit):	4.954515715225973
Encrypted:	false
SSDEEP:	384:/otedXg+PbuGjitKAmol81K3kVynPkSWTXqe0aAFTRNNiyNIJZ4p/9lGlwITRLLS:/otedXg+PbuGjitKAll81K0VynPkSaXI
MD5:	90094857323BFB26FFC23BE11C03212A
SHA1:	A7F6400D246CC595EF62DE0BFC984BFC6D9CCFC5
SHA-256:	8ABDEDEA91E7CCF799C0636AE769684E84A63560BEEC0D1AA56B8DB93FAF1DDD
SHA-512:	149396858A43C9F7888E740D1F6E56CA49503DCEA31C1C24D25E3EA4EA58FCEBD64B9D6800D7B211D46208193B1F23376FE454DA4E00BB817BA25A6E880E0391
Malicious:	false
Preview:	Nov 21 19:00:20 galassia kernel: [ 560.673071] blocking signal 9: 6240 -> 658.Nov 21 19:00:20 galassia kernel: [ 560.674370] blocking signal 9: 6240 -> 720.Nov 21 19:00:20 galassia kernel: [ 560.684081] blocking signal 9: 6240 -> 772.Nov 21 19:00:20 galassia kernel: [ 560.696636] blocking signal 9: 6240 -> 936.Nov 21 19:00:20 galassia kernel: [ 560.700669] blocking signal 9: 6240 -> 2048.Nov 21 19:00:20 galassia kernel: [ 561.288313] New task spawned: old: (tgid 6985, tid 6985), new (tgid: 6985, tid: 7026).Nov 21 19:00:20 galassia kernel: [ 561.289579] New task spawned: old: (tgid 6985, tid 6985), new (tgid: 6985, tid: 7027).Nov 21 19:00:20 galassia kernel: [ 561.301977] New task spawned: old: (tgid 6985, tid 7027), new (tgid: 6985, tid: 7028).Nov 21 19:00:21 galassia kernel: [ 562.391435] New task spawned: old: (tgid 6981, tid 6981), new (tgid: 6981, tid: 7030).Nov 21 19:00:21 galassia kernel: [ 562.466933] New task spawned: old: (tgid 7029, tid 7029), new (tgid: 7031, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	31886
Entropy (8bit):	5.112655103428031
Encrypted:	false
SSDEEP:	768:/7B8lmrdSlEuCNNEtF+Rotep1dXA3Tel1HMAgSg+PKbKfguGjkitKAllw8l1Ke00:wIu
MD5:	080096499970A980EB628BDE3F6D35EB
SHA1:	8C8FFA6ECE959146EB56F3C1B2CC627FA173BDD6
SHA-256:	6E181E3901762484F967CC09FDEDBD5EDAADFAC5C9DF068E484083CC3B1807F9
SHA-512:	E731FB5CE656C02AAD4453BFAC8B4707393C2A5CA0C43648CF26A8A454B2AFE8626B6F30D3EFFF345B60B0690BCE47BD8A08A7D479A709971716AD58ACA7DBB1
Malicious:	false
Preview:	Nov 21 19:00:20 galassia kernel: [ 560.602139] systemd[1]: Starting Journal Service....Nov 21 19:00:20 galassia kernel: [ 560.603240] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Nov 21 19:00:20 galassia kernel: [ 560.603354] systemd[1]: whoopsie.service: Failed with result 'signal'..Nov 21 19:00:20 galassia kernel: [ 560.606595] systemd[1]: getty@tty2.service: Succeeded..Nov 21 19:00:20 galassia kernel: [ 560.608316] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 6..Nov 21 19:00:20 galassia kernel: [ 560.608326] systemd[1]: Stopped Getty on tty2..Nov 21 19:00:20 galassia kernel: [ 560.609176] systemd[1]: Started Getty on tty2..Nov 21 19:00:20 galassia kernel: [ 560.609774] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Nov 21 19:00:20 galassia kernel: [ 560.609866] systemd[1]: rsyslog.service: Failed with result 'signal'..Nov 21 19:00:20 galassia kernel: [ 560.623809] systemd[1]: dbu

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:HCsXlXEWtl/Rlx:Hf+ylpl
MD5:	62CC9902756DE8C0AD03FC8DEB719F27
SHA1:	6C856844386AD20358639E81587EABA320C2CC7E
SHA-256:	BDCEEFBD55AAA0DE98E16A5E3A04AE34C93544E10795D253B9A8552CEFBD991A
SHA-512:	8FEA2152B38AA48776DD2683B0C368FC1F33F26C9CADDC17CA0453A50D8A9E94DC1756A9E9207CBA7F612491A9EE85F886CD2051861B966F344011F1384420E4
Malicious:	true
Preview:	..../...tty2.tty2.......................tty2LOGIN.............................................................................................................................................................................................................................................................................................../.....?g........................................

Source: vwkjebwi686.elf	ReversingLabs: Detection: 42%
Source: vwkjebwi686.elf	Virustotal: Detection: 38%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:49664 -> 154.216.16.109:33966

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.871338879049302
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	vwkjebwi686.elf
File size:	123'084 bytes
MD5:	f687fbb52b0ece060e753101bea9e83f
SHA1:	11f5577b31b3045754f55cd247d1a905d36d0591
SHA256:	8ba62f525366d1870f0c4e64a68ad0562384019a632e2941ce24c17eed6721fd
SHA512:	f28dbf845859e7e1ebbcbb619821dd239759be52a7b048bc11125563e43e9116ca6451f6874083196605647100ecf652684130ca3c3dd93138c4b3ed4672d9a8
SSDEEP:	3072:bmN5GEy/TydupYDzIrDHd85kANmRHpC3SBvG:bmN5GEy/TaupYDErUiBvG
TLSH:	8AC348C0FA4BC1F1C9570870906BF73FCA32D4695121DA6EDFA99E32DE63442D60A798
File Content Preview:	.ELF....................h...4...<.......4. ...(.....................s...s...............x...x'..x'...G..............Q.td............................U..S............h....3j..[]...$.............U......=.o...t..1.....'......'......u........t...$t...........o

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	122684
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x16a61	0x0	0x6	AX	16
.fini	PROGBITS	0x805eb11	0x16b11	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805eb40	0x16b40	0x2c33	0x0	0x2	A	32
.ctors	PROGBITS	0x8062778	0x19778	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x8062784	0x19784	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x80627a0	0x197a0	0x475c	0x0	0x3	WA	32
.bss	NOBITS	0x8066f00	0x1defc	0x492c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1defc	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x19773	0x19773	6.4694	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x19778	0x8062778	0x8062778	0x4784	0x90b4	0.3830	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 01:57:57.556600094 CET	51905	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:57:57.954945087 CET	53	51905	8.8.8.8	192.168.2.23
Nov 22, 2024 01:57:57.955204964 CET	41563	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:57:58.077831030 CET	53	41563	8.8.8.8	192.168.2.23
Nov 22, 2024 01:57:58.078792095 CET	57832	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:57:58.201353073 CET	53	57832	8.8.8.8	192.168.2.23
Nov 22, 2024 01:57:58.201829910 CET	49751	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:57:58.324335098 CET	53	49751	8.8.8.8	192.168.2.23
Nov 22, 2024 01:57:58.324531078 CET	38961	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:57:58.446892023 CET	53	38961	8.8.8.8	192.168.2.23
Nov 22, 2024 01:57:58.446997881 CET	34559	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:57:58.569358110 CET	53	34559	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.080266953 CET	58604	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:00.202682018 CET	53	58604	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.202830076 CET	57615	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:00.325510025 CET	53	57615	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.325648069 CET	52792	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:00.448364019 CET	53	52792	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.448497057 CET	37421	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:00.571161032 CET	53	37421	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.571266890 CET	44584	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:00.693778992 CET	53	44584	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.693948984 CET	37335	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:00.816871881 CET	53	37335	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.817027092 CET	53819	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:00.943223000 CET	53	53819	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:00.943341970 CET	36302	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:01.068192005 CET	53	36302	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:01.068310022 CET	37861	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:01.191245079 CET	53	37861	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:01.191356897 CET	53384	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:01.313795090 CET	53	53384	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:02.837848902 CET	59925	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:02.960252047 CET	53	59925	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:02.960534096 CET	35662	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.083877087 CET	53	35662	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.084261894 CET	44324	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.206924915 CET	53	44324	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.207251072 CET	55977	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.329775095 CET	53	55977	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.329977989 CET	40848	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.452742100 CET	53	40848	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.453044891 CET	51176	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.578198910 CET	53	51176	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.578568935 CET	57362	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.701014042 CET	53	57362	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.701307058 CET	36476	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.823738098 CET	53	36476	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.824109077 CET	52608	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:03.946485043 CET	53	52608	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:03.946738005 CET	34130	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:04.069510937 CET	53	34130	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:05.534845114 CET	49622	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:05.657180071 CET	53	49622	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:05.657507896 CET	42119	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:05.780265093 CET	53	42119	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:05.780555010 CET	37818	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:05.903007984 CET	53	37818	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:05.903487921 CET	58340	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:06.025976896 CET	53	58340	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:06.026526928 CET	42174	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:06.149058104 CET	53	42174	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:06.149384022 CET	41552	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:06.271980047 CET	53	41552	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:06.272145987 CET	53595	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:06.394479036 CET	53	53595	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:06.394870043 CET	57385	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:06.517154932 CET	53	57385	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:06.517611980 CET	58430	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:06.639754057 CET	53	58430	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:06.639926910 CET	38038	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:06.762123108 CET	53	38038	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:29.821270943 CET	57081	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:29.943660021 CET	53	57081	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:29.943931103 CET	35868	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.066689968 CET	53	35868	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.067055941 CET	53320	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.189414024 CET	53	53320	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.189830065 CET	55853	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.312067986 CET	53	55853	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.312360048 CET	51949	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.434847116 CET	53	51949	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.435054064 CET	46323	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.557452917 CET	53	46323	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.558007002 CET	40508	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.680413008 CET	53	40508	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.680875063 CET	34507	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.803158998 CET	53	34507	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.803364992 CET	54640	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:30.925633907 CET	53	54640	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:30.925883055 CET	59399	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:31.048101902 CET	53	59399	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:47.613312960 CET	47570	53	192.168.2.23	1.1.1.1
Nov 22, 2024 01:58:47.613353014 CET	58961	53	192.168.2.23	1.1.1.1
Nov 22, 2024 01:58:47.750597954 CET	53	58961	1.1.1.1	192.168.2.23
Nov 22, 2024 01:58:47.837316036 CET	53	47570	1.1.1.1	192.168.2.23
Nov 22, 2024 01:58:48.357603073 CET	42563	53	192.168.2.23	1.1.1.1
Nov 22, 2024 01:58:48.496181011 CET	53	42563	1.1.1.1	192.168.2.23
Nov 22, 2024 01:58:54.112670898 CET	41394	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:54.235064030 CET	53	41394	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:54.235193014 CET	44756	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:54.358058929 CET	53	44756	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:54.358177900 CET	56247	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:54.480490923 CET	53	56247	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:54.480592966 CET	59787	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:54.602796078 CET	53	59787	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:54.602894068 CET	34525	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:54.725151062 CET	53	34525	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:54.725265980 CET	58598	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:54.848181009 CET	53	58598	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:54.848306894 CET	33215	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:54.970504045 CET	53	33215	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:54.970597982 CET	41571	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:55.092880011 CET	53	41571	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:55.092991114 CET	42964	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:55.215208054 CET	53	42964	8.8.8.8	192.168.2.23
Nov 22, 2024 01:58:55.215337038 CET	43831	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:58:55.337865114 CET	53	43831	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:11.258585930 CET	52761	53	192.168.2.23	1.1.1.1
Nov 22, 2024 01:59:11.397177935 CET	53	52761	1.1.1.1	192.168.2.23
Nov 22, 2024 01:59:18.353158951 CET	45553	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:18.475482941 CET	53	45553	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:18.475595951 CET	59536	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:18.597810030 CET	53	59536	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:18.597959995 CET	38528	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:18.720221996 CET	53	38528	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:18.720336914 CET	50911	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:18.842725039 CET	53	50911	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:18.842873096 CET	36738	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:18.965359926 CET	53	36738	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:18.965466976 CET	43495	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:19.087692976 CET	53	43495	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:19.087793112 CET	35549	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:19.209960938 CET	53	35549	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:19.210052013 CET	46727	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:19.332941055 CET	53	46727	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:19.333045006 CET	36924	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:19.455336094 CET	53	36924	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:19.455427885 CET	42782	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:19.577838898 CET	53	42782	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:27.125432968 CET	60871	53	192.168.2.23	1.1.1.1
Nov 22, 2024 01:59:27.265037060 CET	53	60871	1.1.1.1	192.168.2.23
Nov 22, 2024 01:59:42.691402912 CET	50151	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:42.813697100 CET	53	50151	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:42.813986063 CET	40380	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:42.936330080 CET	53	40380	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:42.936554909 CET	54856	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.059199095 CET	53	54856	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:43.059631109 CET	45063	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.182337999 CET	53	45063	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:43.182665110 CET	60442	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.305037022 CET	53	60442	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:43.305356979 CET	56599	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.427606106 CET	53	56599	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:43.427803040 CET	58333	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.550486088 CET	53	58333	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:43.550726891 CET	41146	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.674011946 CET	53	41146	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:43.674133062 CET	34738	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.798198938 CET	53	34738	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:43.798297882 CET	38850	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:43.921672106 CET	53	38850	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:45.355501890 CET	50520	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:45.477679014 CET	53	50520	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:45.477762938 CET	59488	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:45.600035906 CET	53	59488	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:45.600126982 CET	35343	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:45.722343922 CET	53	35343	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:45.722444057 CET	40446	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:45.845725060 CET	53	40446	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:45.845825911 CET	54677	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:45.969465971 CET	53	54677	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:45.969558954 CET	57001	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:46.092161894 CET	53	57001	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:46.092262030 CET	48828	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:46.215226889 CET	53	48828	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:46.215342045 CET	36444	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:46.337547064 CET	53	36444	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:46.337635994 CET	35878	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:46.462364912 CET	53	35878	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:46.462445974 CET	53820	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:46.584656954 CET	53	53820	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.002937078 CET	45284	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.125369072 CET	53	45284	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.125461102 CET	55276	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.247726917 CET	53	55276	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.247837067 CET	56329	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.370131969 CET	53	56329	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.370208979 CET	59164	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.492525101 CET	53	59164	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.492621899 CET	55447	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.617392063 CET	53	55447	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.617484093 CET	41916	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.739643097 CET	53	41916	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.739736080 CET	38241	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.861880064 CET	53	38241	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.862037897 CET	51765	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:48.985130072 CET	53	51765	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:48.985218048 CET	44878	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:49.108938932 CET	53	44878	8.8.8.8	192.168.2.23
Nov 22, 2024 01:59:49.109034061 CET	56643	53	192.168.2.23	8.8.8.8
Nov 22, 2024 01:59:49.231585026 CET	53	56643	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:12.316817999 CET	47877	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:12.439120054 CET	53	47877	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:12.439419985 CET	36906	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:12.562422037 CET	53	36906	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:12.562642097 CET	41545	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:12.684978008 CET	53	41545	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:12.685254097 CET	51585	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:12.808474064 CET	53	51585	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:12.808825970 CET	45908	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:12.931149006 CET	53	45908	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:12.931375980 CET	37990	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:13.053714991 CET	53	37990	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:13.053910971 CET	41896	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:13.176245928 CET	53	41896	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:13.176429033 CET	38539	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:13.298686028 CET	53	38539	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:13.298974037 CET	59919	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:13.421401978 CET	53	59919	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:13.421711922 CET	41304	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:13.544020891 CET	53	41304	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:24.507251978 CET	40720	53	192.168.2.23	1.1.1.1
Nov 22, 2024 02:00:24.507349968 CET	59790	53	192.168.2.23	1.1.1.1
Nov 22, 2024 02:00:24.644952059 CET	53	59790	1.1.1.1	192.168.2.23
Nov 22, 2024 02:00:24.727341890 CET	53	40720	1.1.1.1	192.168.2.23
Nov 22, 2024 02:00:36.558199883 CET	53726	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:36.680794954 CET	53	53726	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:36.681202888 CET	33550	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:36.804013014 CET	53	33550	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:36.804455996 CET	54691	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:36.927134991 CET	53	54691	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:36.927464962 CET	49461	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:37.049843073 CET	53	49461	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:37.050153017 CET	47347	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:37.172619104 CET	53	47347	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:37.172914982 CET	57335	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:37.295335054 CET	53	57335	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:37.295707941 CET	38911	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:37.418535948 CET	53	38911	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:37.418699980 CET	52970	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:37.541040897 CET	53	52970	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:37.541316986 CET	60078	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:37.663765907 CET	53	60078	8.8.8.8	192.168.2.23
Nov 22, 2024 02:00:37.663893938 CET	51216	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:00:37.786190033 CET	53	51216	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:00.887096882 CET	44969	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.009565115 CET	53	44969	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.009848118 CET	38468	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.132286072 CET	53	38468	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.132468939 CET	49056	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.255199909 CET	53	49056	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.255419970 CET	49309	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.377873898 CET	53	49309	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.378206015 CET	58781	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.500791073 CET	53	58781	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.501192093 CET	50704	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.623419046 CET	53	50704	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.623743057 CET	60914	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.746129990 CET	53	60914	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.746339083 CET	58093	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.868697882 CET	53	58093	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.868892908 CET	49342	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:01.991236925 CET	53	49342	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:01.991576910 CET	51936	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:02.113859892 CET	53	51936	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:03.580982924 CET	52853	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:03.705950975 CET	53	52853	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:03.706228018 CET	49097	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:03.828511953 CET	53	49097	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:03.828634024 CET	54391	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:03.952455044 CET	53	54391	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:03.952644110 CET	52044	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:04.078460932 CET	53	52044	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:04.078639984 CET	42275	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:04.201045990 CET	53	42275	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:04.201224089 CET	34098	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:04.325042009 CET	53	34098	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:04.325176001 CET	39851	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:04.447504044 CET	53	39851	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:04.447645903 CET	35513	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:04.570810080 CET	53	35513	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:04.571008921 CET	50383	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:04.693304062 CET	53	50383	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:04.693622112 CET	57739	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:04.816039085 CET	53	57739	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:06.283556938 CET	38901	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:06.405855894 CET	53	38901	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:06.406049967 CET	53025	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:06.528995037 CET	53	53025	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:06.529176950 CET	60196	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:06.651473999 CET	53	60196	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:06.651902914 CET	57126	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:06.774151087 CET	53	57126	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:06.774573088 CET	35946	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:06.896866083 CET	53	35946	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:06.897083044 CET	53058	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:07.019408941 CET	53	53058	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:07.019695044 CET	38978	53	192.168.2.23	8.8.8.8
Nov 22, 2024 02:01:07.141995907 CET	53	38978	8.8.8.8	192.168.2.23
Nov 22, 2024 02:01:07.142127037 CET	48551	53	192.168.2.23	8.8.8.8

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 22, 2024 01:58:46.169774055 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Nov 22, 2024 02:00:06.185861111 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-11-22 00:58:53 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-11-22 00:58:54 UTC	25	IN	HTTP/1.1 100 Continue
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-11-22 00:58:54 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-11-22 00:58:55 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Fri, 22 Nov 2024 00:58:55 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	00:57:56
Start date (UTC):	22/11/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	/tmp/vwkjebwi686.elf
File size:	123084 bytes
MD5 hash:	f687fbb52b0ece060e753101bea9e83f

Start time (UTC):	00:57:58
Start date (UTC):	22/11/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	-
File size:	123084 bytes
MD5 hash:	f687fbb52b0ece060e753101bea9e83f

Start time (UTC):	00:59:26
Start date (UTC):	22/11/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	-
File size:	123084 bytes
MD5 hash:	f687fbb52b0ece060e753101bea9e83f

Start time (UTC):	00:57:57
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:39
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:40
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:43
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:44
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:45
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:46
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:47
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vwkjebwi686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6939/oom_score_adj

/proc/7099/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75805R892rl

/run/systemd/journal/streams/.#9:75808lzI4Fm

/run/systemd/journal/streams/.#9:76107sQXUnn

/run/systemd/journal/streams/.#9:76111FLcd5l

/run/systemd/journal/streams/.#9:76116qn9grj

/run/systemd/journal/streams/.#9:76346ya0IDm

/run/systemd/journal/streams/.#9:76347pn0tUj

/run/systemd/journal/streams/.#9:764798fql2k

/run/systemd/journal/streams/.#9:76538eDXhCk

/run/systemd/journal/streams/.#9:76616TFLFzl

/run/systemd/journal/streams/.#9:76689ovlqKm

/run/systemd/journal/streams/.#9:76701WD9ONk

/run/systemd/journal/streams/.#9:767902uM0am

/run/systemd/journal/streams/.#9:77713qGsVok

/run/systemd/journal/streams/.#9:78039rd8KKm

/run/systemd/journal/streams/.#9:78136YfZ7Rk

/run/systemd/journal/streams/.#9:78139pp682i

/run/systemd/journal/streams/.#9:78152LRnpgn

Linux Analysis Report
vwkjebwi686.elf

Start time (UTC):	00:58:48
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:49
Start date (UTC):	22/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:58:50
Start date (UTC):	22/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:58:51
Start date (UTC):	22/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	00:58:52
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:58:53
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:59:03
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	00:59:05
Start date (UTC):	22/11/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	00:59:06
Start date (UTC):	22/11/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	00:59:04
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75