Edit tour

Linux Analysis Report
vkjqpc.elf

Overview

General Information

Sample name:	vkjqpc.elf
Analysis ID:	1560637
MD5:	5c577c051d86c9e78be3278fe982f98b
SHA1:	7bb1697b41891de5a6007811d9bcbe23f69b21a6
SHA256:	3e4410cf69e2a10499aa4c2e5ffb72e909783cb9aa5fb76fab7d709454625b8c
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1560637
Start date and time:	2024-11-22 03:57:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vkjqpc.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/146@134/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/vkjqpc.elf
PID:	6236
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

vkjqpc.elf (PID: 6236, Parent: 6160, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/vkjqpc.elf

vkjqpc.elf New Fork (PID: 6238, Parent: 6236)

vkjqpc.elf New Fork (PID: 6240, Parent: 6238)

vkjqpc.elf New Fork (PID: 6402, Parent: 6240)

sh (PID: 6402, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6408, Parent: 6402)

ps (PID: 6408, Parent: 6402, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

vkjqpc.elf New Fork (PID: 6822, Parent: 6240)

sh (PID: 6822, Parent: 6240, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6825, Parent: 6822)

ps (PID: 6825, Parent: 6822, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6242, Parent: 1477)

sh (PID: 6242, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6242, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6249, Parent: 1)

systemd-hostnamed (PID: 6249, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6397, Parent: 1320)

Default (PID: 6397, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6401, Parent: 1320)

Default (PID: 6401, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6461, Parent: 1)

journalctl (PID: 6461, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6480, Parent: 1)

systemd-journald (PID: 6480, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6481, Parent: 1)

journalctl (PID: 6481, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

gdm3 New Fork (PID: 6497, Parent: 1320)

Default (PID: 6497, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6499, Parent: 1860)

pulseaudio (PID: 6499, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6500, Parent: 1)

dbus-daemon (PID: 6500, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6502, Parent: 1)

rsyslogd (PID: 6502, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6509, Parent: 1)

systemd-logind (PID: 6509, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6568, Parent: 1)

rtkit-daemon (PID: 6568, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6572, Parent: 1)

polkitd (PID: 6572, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6575, Parent: 1)

gpu-manager (PID: 6575, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6577, Parent: 6575)

sh (PID: 6577, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6581, Parent: 6577)

grep (PID: 6581, Parent: 6577, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6583, Parent: 6575)

sh (PID: 6583, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6584, Parent: 6583)

grep (PID: 6584, Parent: 6583, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6586, Parent: 6575)

sh (PID: 6586, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6587, Parent: 6586)

grep (PID: 6587, Parent: 6586, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6588, Parent: 6575)

sh (PID: 6588, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6590, Parent: 6575)

sh (PID: 6590, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6591, Parent: 6590)

grep (PID: 6591, Parent: 6590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6592, Parent: 6575)

sh (PID: 6592, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6593, Parent: 6592)

grep (PID: 6593, Parent: 6592, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6595, Parent: 6575)

sh (PID: 6595, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6599, Parent: 6595)

grep (PID: 6599, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6600, Parent: 6575)

sh (PID: 6600, Parent: 6575, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6601, Parent: 6600)

grep (PID: 6601, Parent: 6600, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6582, Parent: 1)

agetty (PID: 6582, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gvfsd-fuse New Fork (PID: 6594, Parent: 2038)

fusermount (PID: 6594, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6606, Parent: 1)

generate-config (PID: 6606, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6607, Parent: 6606)

pkill (PID: 6607, Parent: 6606, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6608, Parent: 1)

gdm-wait-for-drm (PID: 6608, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6614, Parent: 1)

gdm3 (PID: 6614, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6617, Parent: 6614)

plymouth (PID: 6617, Parent: 6614, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6627, Parent: 6614)

gdm-session-worker (PID: 6627, Parent: 6614, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm3 New Fork (PID: 6634, Parent: 6614)

Default (PID: 6634, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6637, Parent: 6614)

Default (PID: 6637, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6618, Parent: 1)

accounts-daemon (PID: 6618, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6622, Parent: 6618)

language-validate (PID: 6622, Parent: 6618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6623, Parent: 6622)

language-options (PID: 6623, Parent: 6622, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6624, Parent: 6623)

sh (PID: 6624, Parent: 6623, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6625, Parent: 6624)

locale (PID: 6625, Parent: 6624, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6626, Parent: 6624)

grep (PID: 6626, Parent: 6624, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6635, Parent: 1)

agetty (PID: 6635, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6636, Parent: 1)

rsyslogd (PID: 6636, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6639, Parent: 1)

dbus-daemon (PID: 6639, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6643, Parent: 1)

gpu-manager (PID: 6643, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6644, Parent: 6643)

sh (PID: 6644, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6645, Parent: 6644)

grep (PID: 6645, Parent: 6644, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6646, Parent: 6643)

sh (PID: 6646, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6647, Parent: 6646)

grep (PID: 6647, Parent: 6646, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6648, Parent: 6643)

sh (PID: 6648, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6649, Parent: 6648)

grep (PID: 6649, Parent: 6648, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6710, Parent: 6643)

sh (PID: 6710, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6711, Parent: 6710)

grep (PID: 6711, Parent: 6710, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6713, Parent: 6643)

sh (PID: 6713, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6714, Parent: 6713)

grep (PID: 6714, Parent: 6713, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6716, Parent: 6643)

sh (PID: 6716, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6717, Parent: 6716)

grep (PID: 6717, Parent: 6716, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6720, Parent: 6643)

sh (PID: 6720, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6721, Parent: 6720)

grep (PID: 6721, Parent: 6720, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6722, Parent: 6643)

sh (PID: 6722, Parent: 6643, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6723, Parent: 6722)

grep (PID: 6723, Parent: 6722, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6653, Parent: 1)

systemd-logind (PID: 6653, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6724, Parent: 1)

generate-config (PID: 6724, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6725, Parent: 6724)

pkill (PID: 6725, Parent: 6724, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6726, Parent: 1)

gdm-wait-for-drm (PID: 6726, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6733, Parent: 1)

rsyslogd (PID: 6733, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6738, Parent: 1)

dbus-daemon (PID: 6738, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6741, Parent: 1)

journalctl (PID: 6741, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6742, Parent: 1)

systemd-journald (PID: 6742, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6745, Parent: 1)

systemd-logind (PID: 6745, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6802, Parent: 1)

agetty (PID: 6802, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6804, Parent: 1)

rsyslogd (PID: 6804, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6805, Parent: 1)

dbus-daemon (PID: 6805, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6810, Parent: 1)

gpu-manager (PID: 6810, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6811, Parent: 6810)

sh (PID: 6811, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6812, Parent: 6811)

grep (PID: 6812, Parent: 6811, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6813, Parent: 6810)

sh (PID: 6813, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6814, Parent: 6813)

grep (PID: 6814, Parent: 6813, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6815, Parent: 6810)

sh (PID: 6815, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6816, Parent: 6815)

grep (PID: 6816, Parent: 6815, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6817, Parent: 6810)

sh (PID: 6817, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6818, Parent: 6817)

grep (PID: 6818, Parent: 6817, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6819, Parent: 6810)

sh (PID: 6819, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6820, Parent: 6819)

grep (PID: 6820, Parent: 6819, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6824, Parent: 6810)

sh (PID: 6824, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6826, Parent: 6824)

grep (PID: 6826, Parent: 6824, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6830, Parent: 6810)

sh (PID: 6830, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6831, Parent: 6830)

grep (PID: 6831, Parent: 6830, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6832, Parent: 6810)

sh (PID: 6832, Parent: 6810, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6833, Parent: 6832)

grep (PID: 6833, Parent: 6832, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6834, Parent: 1)

journalctl (PID: 6834, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6835, Parent: 1)

generate-config (PID: 6835, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6836, Parent: 6835)

pkill (PID: 6836, Parent: 6835, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6840, Parent: 1)

gdm-wait-for-drm (PID: 6840, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6845, Parent: 1)

gdm3 (PID: 6845, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6848, Parent: 6845)

plymouth (PID: 6848, Parent: 6845, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6862, Parent: 6845)

gdm-session-worker (PID: 6862, Parent: 6845, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6866, Parent: 6862)

gdm-wayland-session (PID: 6866, Parent: 6862, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6868, Parent: 6866)

dbus-daemon (PID: 6868, Parent: 6866, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6872, Parent: 6868)

dbus-daemon New Fork (PID: 6873, Parent: 6872)

false (PID: 6873, Parent: 6872, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6874, Parent: 6866)

dbus-run-session (PID: 6874, Parent: 6866, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6875, Parent: 6874)

dbus-daemon (PID: 6875, Parent: 6874, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6876, Parent: 6845)

Default (PID: 6876, Parent: 6845, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6877, Parent: 6845)

Default (PID: 6877, Parent: 6845, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6849, Parent: 1)

accounts-daemon (PID: 6849, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6853, Parent: 6849)

language-validate (PID: 6853, Parent: 6849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6854, Parent: 6853)

language-options (PID: 6854, Parent: 6853, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6855, Parent: 6854)

sh (PID: 6855, Parent: 6854, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6856, Parent: 6855)

locale (PID: 6856, Parent: 6855, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6857, Parent: 6855)

grep (PID: 6857, Parent: 6855, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6858, Parent: 1)

polkitd (PID: 6858, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6891, Parent: 1860)

dbus-daemon (PID: 6891, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6892, Parent: 1860)

pulseaudio (PID: 6892, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6893, Parent: 1)

rtkit-daemon (PID: 6893, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6894, Parent: 1)

journalctl (PID: 6894, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6895, Parent: 1)

dbus-daemon (PID: 6895, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6896, Parent: 1)

agetty (PID: 6896, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6899, Parent: 1)

systemd-logind (PID: 6899, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6949, Parent: 1)

rsyslogd (PID: 6949, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6958, Parent: 1)

systemd-journald (PID: 6958, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6959, Parent: 1)

dbus-daemon (PID: 6959, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6960, Parent: 1)

rsyslogd (PID: 6960, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6964, Parent: 1)

gpu-manager (PID: 6964, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6968, Parent: 6964)

sh (PID: 6968, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6969, Parent: 6968)

grep (PID: 6969, Parent: 6968, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6971, Parent: 6964)

sh (PID: 6971, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6972, Parent: 6971)

grep (PID: 6972, Parent: 6971, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6973, Parent: 6964)

sh (PID: 6973, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6974, Parent: 6973)

grep (PID: 6974, Parent: 6973, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6975, Parent: 6964)

sh (PID: 6975, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6976, Parent: 6975)

grep (PID: 6976, Parent: 6975, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6978, Parent: 6964)

sh (PID: 6978, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6979, Parent: 6978)

grep (PID: 6979, Parent: 6978, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6981, Parent: 6964)

sh (PID: 6981, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6982, Parent: 6981)

grep (PID: 6982, Parent: 6981, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6983, Parent: 6964)

sh (PID: 6983, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6984, Parent: 6983)

grep (PID: 6984, Parent: 6983, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6985, Parent: 6964)

sh (PID: 6985, Parent: 6964, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6986, Parent: 6985)

grep (PID: 6986, Parent: 6985, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6987, Parent: 1)

generate-config (PID: 6987, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6988, Parent: 6987)

pkill (PID: 6988, Parent: 6987, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6991, Parent: 1)

journalctl (PID: 6991, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6992, Parent: 1)

gdm-wait-for-drm (PID: 6992, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7000, Parent: 1)

gdm3 (PID: 7000, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7003, Parent: 7000)

plymouth (PID: 7003, Parent: 7000, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7017, Parent: 7000)

gdm-session-worker (PID: 7017, Parent: 7000, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7025, Parent: 7017)

gdm-wayland-session (PID: 7025, Parent: 7017, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7027, Parent: 7025)

dbus-daemon (PID: 7027, Parent: 7025, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7032, Parent: 7027)

dbus-daemon New Fork (PID: 7033, Parent: 7032)

false (PID: 7033, Parent: 7032, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7034, Parent: 7025)

dbus-run-session (PID: 7034, Parent: 7025, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7035, Parent: 7034)

dbus-daemon (PID: 7035, Parent: 7034, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7036, Parent: 7000)

Default (PID: 7036, Parent: 7000, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7037, Parent: 7000)

Default (PID: 7037, Parent: 7000, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7004, Parent: 1)

accounts-daemon (PID: 7004, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7008, Parent: 7004)

language-validate (PID: 7008, Parent: 7004, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7009, Parent: 7008)

language-options (PID: 7009, Parent: 7008, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7010, Parent: 7009)

sh (PID: 7010, Parent: 7009, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7011, Parent: 7010)

locale (PID: 7011, Parent: 7010, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7012, Parent: 7010)

grep (PID: 7012, Parent: 7010, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7013, Parent: 1)

polkitd (PID: 7013, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7023, Parent: 1)

systemd (PID: 7023, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7028, Parent: 7023)

systemd New Fork (PID: 7029, Parent: 7028)

30-systemd-environment-d-generator (PID: 7029, Parent: 7028, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7040, Parent: 7023)

systemctl (PID: 7040, Parent: 7023, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7041, Parent: 7023)

pulseaudio (PID: 7041, Parent: 7023, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7049, Parent: 7023)

dbus-daemon (PID: 7049, Parent: 7023, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7042, Parent: 1)

rtkit-daemon (PID: 7042, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vkjqpc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
vkjqpc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fcd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fcec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6236.1.00007fa454001000.00007fa454024000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6236.1.00007fa454001000.00007fa454024000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1fcd8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fcec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd00:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd14:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd28:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd3c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd50:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fd8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1fe68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: vkjqpc.elf PID: 6236	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: vkjqpc.elf PID: 6236	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x11050:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11064:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11078:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1108c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x110f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11104:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11118:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1112c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11140:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11154:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11168:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1117c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11190:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x111e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6502)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6636)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6733)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6804)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6960)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6480)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6614)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6845)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6868)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6958)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7000)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7027)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7035)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7023)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.119.dr, syslog.292.dr, syslog.171.dr, syslog.43.dr, syslog.183.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 38376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38376
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: vkjqpc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 840, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 840, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4390, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4495, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4501, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4526, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6198, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6267, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6400, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6402, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6408, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6633, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6635, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6636, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6729, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6738, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6220, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6499, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6803, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6804, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6822, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6825, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6845, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6891, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6892, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6894, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6895, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6949, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6950, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 840, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2294, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4390, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4495, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4501, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 4526, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6070, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6182, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6198, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6220, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6267, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6400, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6402, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6408, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6633, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6635, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6636, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6729, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6738, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6220, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6499, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6803, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6804, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6822, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6825, result: no such process	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6845, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6891, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6892, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6894, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6895, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6949, result: successful	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6240)	SIGKILL sent: pid: 6950, result: successful	Jump to behavior

Source: vkjqpc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/146@134/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6500)	File: /proc/6500/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6594)	File: /proc/6594/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6639)	File: /proc/6639/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6738)	File: /proc/6738/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6805)	File: /proc/6805/mounts
Source: /usr/bin/dbus-daemon (PID: 6868)	File: /proc/6868/mounts
Source: /usr/bin/dbus-daemon (PID: 6875)	File: /proc/6875/mounts
Source: /usr/bin/dbus-daemon (PID: 6891)	File: /proc/6891/mounts
Source: /usr/bin/dbus-daemon (PID: 6959)	File: /proc/6959/mounts
Source: /usr/bin/dbus-daemon (PID: 7027)	File: /proc/7027/mounts
Source: /usr/bin/dbus-daemon (PID: 7035)	File: /proc/7035/mounts
Source: /usr/bin/dbus-daemon (PID: 7049)	File: /proc/7049/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6249)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76023qdZKjc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76026LdebEc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76157EaUxla	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:75703Ccg7x9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:75718hYkbGb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:764247BvMw9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:764261mY1O9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76553lNjp9a	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76651j4b6zd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76658Opsora	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76670IX8sya	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76677pJCtOd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:76756tjufTd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:778809RweMb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:77915yj10qb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:77916zlcAU9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:77934wCZSC9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:78130snG7Id	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:78142RIDYdd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:782802zH7Ua	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:78325uC3Hua	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:79192dYjvca	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:78386EQv7Ma	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	File: /run/systemd/journal/streams/.#9:79383vPqPAb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/seats/.#seat0T23q6m	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6572)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6653)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6653)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6653)	File: /run/systemd/seats/.#seat0noSHCe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:79806nLDkP0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:79807Xrbw60	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:79815lwIjb2	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:79821pSAKBY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:79827psxzuZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:798368Tspb1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:79837cbdN4X	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80939r7seWZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80222bfx5q1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80316EkvAKZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80334ufdhS1	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80359RQo9W0	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80361PRnDWX	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80391amQCuY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80392Kg05rZ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:812788pPs0Y	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:813213jU740	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	File: /run/systemd/journal/streams/.#9:80810MNaO4Y	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6745)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6745)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/seats/.#seat01okSCf
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/users/.#127tg557b
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/users/.#127q8Rsoc
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/seats/.#seat0CI8n5d
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/users/.#127hbGgBf
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/users/.#1274xBuhd
Source: /lib/systemd/systemd-logind (PID: 6745)	File: /run/systemd/users/.#127lKvyWb
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6866)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6858)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6899)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6899)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/seats/.#seat0C0Gl2T
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/users/.#127NimYKS
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/users/.#127gCNrFS
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/seats/.#seat01ax7uQ
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/users/.#127npF7RT
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/users/.#127N0bxbQ
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/users/.#127sb3zDR
Source: /lib/systemd/systemd-logind (PID: 6899)	File: /run/systemd/users/.#127GlMhLT
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81883C5jxik
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81884o2WO9j
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81885NpMDVk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81892gAsCBm
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81899e9HWPj
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:819008H0uUm
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81906ent2Ui
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81914JFZXqm
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:81920FByXFi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:829459iP4Jk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:830205Bi3Rm
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83031WwSxFl
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:831266k4J4i
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83171ry8iEi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:83173BMB08l
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:82913dMVLjl
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:82924XIjMBj
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:82925DWpfHi
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84061cTyZJl
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84066lG04uk
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:84072Axu2Ij
Source: /lib/systemd/systemd-journald (PID: 6958)	File: /run/systemd/journal/streams/.#9:8412967yg8i
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7025)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7013)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7023)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7029)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7023/status
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7028/comm
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7049/stat
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7049/comm
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7049/cgroup
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7040/comm
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7040/cgroup
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7041/stat
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7041/cgroup
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7041/cgroup
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/7041/comm
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/1/environ
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/1/sched
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7023)	File opened: /proc/1/comm
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/3088/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/3088/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/910/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/910/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/6240/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/6240/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/126/status
Source: /usr/bin/pkill (PID: 6988)	File opened: /proc/126/cmdline

Source: /tmp/vkjqpc.elf (PID: 6402)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/vkjqpc.elf (PID: 6822)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6577)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6583)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6590)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6592)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6600)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6624)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6644)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6646)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6648)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6710)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6713)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6716)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6720)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6722)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6811)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6813)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6815)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6817)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6819)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6824)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6830)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6832)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6855)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6968)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6971)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6973)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6975)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6978)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6981)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6983)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6985)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7010)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6581)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6584)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6587)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6591)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6593)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6599)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6601)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6626)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6645)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6647)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6649)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6711)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6714)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6717)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6721)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6723)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6812)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6814)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6816)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6818)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6820)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6826)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6831)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6833)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6857)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6969)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6972)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6974)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6976)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6979)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6982)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6984)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6986)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7012)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6607)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6725)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6836)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6988)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6408)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6825)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7040)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6408)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6825)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6958)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6582)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6635)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6802)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6896)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6614)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6614)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6845)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6845)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7000)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7000)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6502)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6502)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6575)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6636)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6636)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6643)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6733)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6804)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6804)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6810)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6960)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6960)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6964)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/vkjqpc.elf (PID: 6238)

File: /tmp/vkjqpc.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6575)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6643)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6810)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6964)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6408)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6825)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6499)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6607)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6725)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6836)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6988)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7041)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/vkjqpc.elf (PID: 6236)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6249)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6480)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6499)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6502)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6575)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6582)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6627)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6635)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6636)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6643)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6733)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6742)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6802)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6804)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6810)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6862)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6896)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6958)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6960)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6964)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7017)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7041)	Queries kernel information via 'uname':

Source: vkjqpc.elf, 6236.1.000055797100e000.00005579710be000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/vkjqpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/vkjqpc.elf
Source: kern.log.292.dr	Binary or memory string: Nov 21 21:00:44 galassia kernel: [ 590.701346] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.gTYa1K
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp	Binary or memory string: myU/tmp/qemu-open.gTYa1K\D
Source: vkjqpc.elf, 6236.1.000055797100e000.00005579710be000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: kern.log.292.dr	Binary or memory string: Nov 21 21:00:44 galassia kernel: [ 590.701372] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: vkjqpc.elf, 6236.1.00007ffc607bb000.00007ffc607dc000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6849)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7004)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vkjqpc.elf, type: SAMPLE
Source: Yara match	File source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: vkjqpc.elf, type: SAMPLE
Source: Yara match	File source: 6236.1.00007fa454001000.00007fa454024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vkjqpc.elf PID: 6236, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vkjqpc.elf	50%	ReversingLabs	Linux.Trojan.Mirai
vkjqpc.elf	40%	Virustotal		Browse
vkjqpc.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
ksdjwi.eye-network.ru	154.216.16.109	true	false	high
ksdjwi.eye-network.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.119.dr, syslog.292.dr, syslog.171.dr, syslog.43.dr, syslog.183.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
154.216.16.109	ksdjwi.eye-network.ru	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	wnbw86.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
154.216.16.109	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	vsbeps.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	wnbw86.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	qkehusl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	wriww68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
ksdjwi.eye-network.ru	vsbeps.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	qkehusl.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	154.216.16.109

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	vsbeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wnbw86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	iwir64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wriww68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	vsbeps.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	wnbw86.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	qkehusl.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	iwir64.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	wriww68k.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	154.216.16.109
CANONICAL-ASGB	vsbeps.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wnbw86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	qkehusl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wriww68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
INIT7CH	vsbeps.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wnbw86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	qkehusl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wriww68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	kjsusa6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6873/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/7033/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.3709505944546687
Encrypted:	false
SSDEEP:	3:mVF:mn
MD5:	3A1D037A7B40E3839FD2315C3AAAA877
SHA1:	6419870FB029C7CBA53E16A1423014BFB6AC5E4F
SHA-256:	09671F09BCCB88C87ACCED40642A061E0D257D13282C22A1128807AAB3D1719B
SHA-512:	32C7989C42CC564AF2185D2894CBEFE586DE813BB957D759AF8F42BB9C690622EE35DDDEC6F2E93D3B339D7E933D48D2399EF8E1F68848A0142B5A650036495F
Malicious:	false
Reputation:	low
Preview:	7000.

/run/systemd/journal/streams/.#9:75703Ccg7x9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.372286854616758
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuGMP56I9zhuqjshQJ:SbFuFyLVIg1BG+f+Mu5P1zMqjtWL0
MD5:	B8381D14CDA269F3F36ABE89ADC2953B
SHA1:	4173FE284F9625D2673D4A2E09709B3C2254D4FE
SHA-256:	A542145D3B6A82404C568D563AD6E19F18BA5EA427E474D2808E7A1FE4FED2C2
SHA-512:	C2895D705049E877C3B10544B3D1FCB9F443D0BEC748A2FB4C454183A29B132E41A13EEA14F9441D345C44C925119B5AC3E7BED3A073656C3EB6E343CBBA5D88
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4d7a5f296fa4381bb7064f32ab22289.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:75718hYkbGb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.375585324465139
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzZvYZihVU3bqjs1Ha:SbFuFyLVIg1BG+f+MtviiI3bqjosQu
MD5:	3A7F9A73D96083D6C58E993E698E1754
SHA1:	930A72CD475B0B7EEBABA1B3A067D7997E1EA5A1
SHA-256:	6E1C792B5156E142AE372BFC988C45AC3DE3D83149D573A6B70DDCE9F145AF43
SHA-512:	5E32B0F9EAFB6318BC3EE40B14EEACAABDBD0999D32AAE5E849D9CF0D6E5BC51AE8D1B81FB80B0E5D0478B4CDD9B9ABBA194AB14AFE5F889EDFD51BB8F957609
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9081da98c1c3434e80a1c5749501dda9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76023qdZKjc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.52549506354132
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4E6wkCV6WTBCvy2jq:SbFuFyLVIg1BG+f+M4wkCV9uji4s
MD5:	9DF21478AF18DE11C64FCF581A0D23BD
SHA1:	DEA06FA47E55020E8C5078A0F1D731FDDF41F146
SHA-256:	B05F6EAF170902330B3FA2600266A6C860C602833610BA3472EC96699BDA78DD
SHA-512:	0F74FAB1144E60874CCAD218B0CE2D8E75008F49BD1A1C7AD0D3648979E710B163C91DE76660CB42FBA715D39692EB876F7B0B2243D218805F16D2AB7D6D77CE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2a8b030330934bf68ed82a636d4b1799.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76026LdebEc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4619349765850105
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuWGGVmHWd/rvsjs77:SbFuFyLVIg1BG+f+MuBGVmHWdD0ji4s
MD5:	C339F6F584F1C0365F564B2F873DBFDF
SHA1:	A538708B9F35DEFA0BD35C14D2DDF304873FE608
SHA-256:	825F85D4AF93B0C32761133E3715BACEB570E06E563C586899E1DD98971C2C38
SHA-512:	CE9700B63FD0251A3075EA29CB85B43D8E02B6452F415F25091CEF5B46139A46C1FF03B2D5ACFD57A79E8E8FACD196CB635DA4731C0348050EACEEC962135947
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4b0ccacc0dd47019b10a8384a9ac39b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76157EaUxla

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.385241068356323
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuFQ9lVnbChvFlsjst:SbFuFyLVIg1BG+f+MuFWVbe0jdCLKzK
MD5:	D6F19D00B3CCDC59FC7FC1254F44CC5A
SHA1:	2AE4BA710138DB4894E92FC55AF7321A4CDCD7D3
SHA-256:	98AA892DA1D6294B8A7FBC638A8275C553FB965C9886A9DE17ADCEC33957A260
SHA-512:	22EE3C6C40EFD55A7ECA9D99E45E6B5957D23A391E953EDC6FA66AFF5776404C55BFCB152A26CA465C031ED0C1063DE80FA6B06813D7A95E327235DC89F7A9A2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d05c885ef3284bc58b0efde39279a9c2.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:764247BvMw9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.437359981620096
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4kATpLP1V1jZcHcljX+:qgFq6g10+f+MKNmAu
MD5:	AB6EDFD35A4EA8854FBFCFDC9BF2E142
SHA1:	F1DC951FECD40C8E2F071802C544A7E4C549DC63
SHA-256:	B2EC20AC86B213128EE54D217DBA81B7A1FCC470D659E0D0BBDD97958E32805C
SHA-512:	945175BB522826AA37BAF7CFD2DF94FCED58B928CADFA739E711606FAEAE043FDCDE1E13CF59C4F8093E6EB4A415296C592E4FAD06BEFBB18EFBA2B1351719AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=73d908efa360435091a0593f6d45a60a.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:764261mY1O9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.475277647978932
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4EXSuBlyDt30huqja:SbFuFyLVIg1BG+f+M4EX7lq0ZjNE
MD5:	55A9038D5A1EC6721AAF4A1FC3B3BADC
SHA1:	8F9A04F068EB6016671EA6172C4433BD3E6CCA60
SHA-256:	EECAFBC9F2D2C0266D5D2FC572F4FC5BC41082019E56DCD9BD236AAD4F1691C7
SHA-512:	A1E5A8E1CFE3F7307AE5444C6C18B5A3F15F6240D5B0670CDDA5A67E56D9D2928CDD2D969B91A480CC9977B0B6F3BB63DBD55A88DC86EAFFB5DE99369F87BCF6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2212b28e88cf46efb676794983a14544.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76553lNjp9a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.377297111372147
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrTceEEIKS0s2lsjs1:SbFuFyLVIg1BG+f+MnQEbTF2jbVC
MD5:	6A8276329956A498D0E66B3EF8B8D8D0
SHA1:	97FEF158202CCA951AFC24E28DF0608504E9FDD1
SHA-256:	C657D4337DF4C77F0AFE01FD967998FB7D06BB5F2A0753FF5C2509DE82822AEB
SHA-512:	B5FF56188E97274FFA3F2748863D7411C2170D6073727C654FC6DE7A0032E82D75FB44E0B684EE55F8CBB6C58405B39C3523B4A4049179CCF39929F40109BEA5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=abb67191bd3243f1a737dbb7943aa7f3.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76651j4b6zd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4180286600314895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpjszUzqTDBC8/sjsV:SbFuFyLVIg1BG+f+M+U2U8kjLkGq
MD5:	2BE4E8891A045A52185FD122B26269F6
SHA1:	42739601B0FC5638A39E816D90D5C61024629E52
SHA-256:	4996FA3CFF3B0E8CD6F98AE4678A68548B1FF0A10FC656CB25B5B13D829625B5
SHA-512:	3874E3D3986A0667CDCDB02D61AEF01F62A0E9EE2D6C98F58C782307E29BD63AA0394F0EDA5B8E1B1F8A4D5E7B788509FD4905F863658622078A54A43934EB4D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cec4d988fe194417b5cbe6420fd8e032.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76658Opsora

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.441514236416421
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MsBGYZdZGqjNALyAZD:qgFq6g1af+MsBbZrpIZD
MD5:	36FC1122A72DE4D030F39DD402936025
SHA1:	2109AFEA87D4B7356DE5DF76390DB5F10989BC37
SHA-256:	DDB1CABDC2E0D3ABDE1B425DDB70E160996F3697C0E7B302E5E89DC19E01D59E
SHA-512:	D5BE585DF4F8003293C994105BA1133725CCBACB04B6D467E7027666F32D0302DD1C50EA08D7CC51885A4FD92B5FBC75A5FC765DDF4D0D4DC06FDD2A393C77D1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fdca359b988048c2ab2ca6514541a84f.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76670IX8sya

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.493674484514609
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MenQRwF4tGhTjNdQIeXD:qgFq6g1af+MqEd2F2D
MD5:	5971B2048032746921C95C79584427B9
SHA1:	DA465322D48DECA109477A596D52AA319CC8F845
SHA-256:	09A2E88B1931A2A23629415D4A4D833507AD345CAD0E6A5FE4E550C4A326B12C
SHA-512:	C9F8E765B51E689A7CDF649C8D3ED4AECDBCB2B0DA83845BDBC81BE0400908B460062A4FD84551081515036EB89FF180672133A31CCF2436637A0916D184569A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9fcbb57e6f484e01911abd97f154232c.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76677pJCtOd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.463048876928792
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M43cyg22jdCt/rRMtq:qgFq6g10+f+M43cyg3CDL
MD5:	4A6198986E6876EE83D146BEDDF8EDD7
SHA1:	41E434637EC0ADA0622999ED4E42A4E5441FC90B
SHA-256:	3455C87AB177D00C6BB3619D01FAAD4CA3D9B355215D8C86B66B406818C9F7F0
SHA-512:	AECF4E039374EDB6FC63B6E2F53EA75F2E667D62F61F00C80C31A0C8B454489698E5264E64D0FDD4179FADA3606BD91A4E50F7D84DD8A324F769D253F37C814F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=15c9889f634449c6aef4bfa35a3b6c20.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76756tjufTd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.412782846125378
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzMZWGw9nUQnv8js2BZd:SbFuFyLVIg1BAf+MIoGw9n7v8jNTZD
MD5:	11759A69609F1891EB0B0B3BECE6236E
SHA1:	9751C092489ED72D2E646975BB2B95721F701A72
SHA-256:	065F7C9188AE291433E8DCB0EC753E5903FE54DECD35D8DB9299BD9151286B47
SHA-512:	795679C7A82CAF4B0D584D491565E6EF3C329192B50FDE3BCB85974E62180AE608EBB0893BDCC5CD3DDBD86EC164B2EDC1E9256F3D8B19E4ACECB71DC8037112
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=96ee6b93cf704459892a4e07156065ad.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:778809RweMb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.411816959404684
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M45DXCNj4xuqjLTTIWTIL:qgFq6g10+f+M45Dav+EWEL
MD5:	A566ABB216B5E27B93C09A882A55DBC9
SHA1:	DBFB98DFBF961233F351D119C87A01AD8C8247DD
SHA-256:	ACD3F552E4DF0BE48390791305F500B5297D2E38B1779245296559E9C9F75F6C
SHA-512:	BCAF0B582D7DD82DC9C226C67C13A170000506AD2AC40172CC64C5A8E30290D7044DBACA0F599240A5D8095C16685420D06C3D41A6D004C3DF654431AFAF30B6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2a60cc19bcdf45599f2efe0f7d0e83ee.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77915yj10qb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.414522789138049
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5CE+V06dR7cyzAs:SbFuFyLVK6g7/+BG+f+MK5crTjNq
MD5:	020D2A55CE683225BE392A7EB1FBEDF4
SHA1:	CE830163538C22478FE0202F4035BA208415698F
SHA-256:	39B28B839CB4C6B9877FDF6095C89FE4818EC65A3E4F89921E98EF19B5256FE9
SHA-512:	9D1AD3658B21008AC6CBE9AB6FFCCBE3CB1EBBB36A3FBB82023A37FE1892839CD5CF9065B32FBC8D7AC3F749EC13D79CC0E28BC0A47E1BBFE4085DFA1882681A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=380718a200c049a0b035c4f7199f09bc.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77916zlcAU9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.384161657619964
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm89RSajdv8js2BD0:SbFuFyLVI6g7/+BG+f+M89RSajd0jNq
MD5:	D5DB09B1718D1BDF9502B81154B2FE5D
SHA1:	C7B255F9522EC30693CBF26E0B266E5F7CC7F076
SHA-256:	265BE600D8DB2DF89472A4F6FD18DE0B19F85CEFF4D76E43992836B2A6059EDC
SHA-512:	5497F692286B08910939C1F1FB7D2EADF6242D33043C33616C5EFF90F43191733B3ABECAB9706B7057F5FFB6ACCAD6CB188558CC504D8A8948D973A2735CE6B9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6241e066877f42cea64ee78a06375314.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77934wCZSC9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.43096114049251
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GBcHvUcQUWCEvFrj:SbFuFyLVIg1BG+f+M4VeRqjdCLKzK
MD5:	1C7ADC0D7C584BA77B3DD82CA6408AAA
SHA1:	B0F77929165412D133274F5E14D3353FA8A5F449
SHA-256:	D7215EB35B70C5A166A87214628200204B63913ED8223531F053B01F20BB5E7D
SHA-512:	7EC40BF075517156765B3B2925B92B0333EC3237DC7B9D7689CF223D0A0EFEE85DCC3BF10236A9C68FB1D46B13AE94F7DCC972C95392C24BC96F9574B51DF740
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2cdb48ac902f4d479165871bb362487a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78130snG7Id

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.439661985776727
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmydwd1SZjs1HadmQXt:SbFuFyLVIg1BG+f+MyRjosQu
MD5:	05D1C3142A8E7B43FC2EB6BA6018111E
SHA1:	B548A2A3044A927998A9293D01B751FFA88BE76B
SHA-256:	44B9B0752032ADD72D665E604B8F228CE91401A721C0BB0EF80B449E831679B7
SHA-512:	835A7CBC7190360BD85A2EEF3A2CA95BBC2F2F6D18662961D3675EC21E868CA32E143DD6F8021C24BC6E8BFDAC4F56F67B1166CD442B32ABB7C2C7D7A5E0816F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=864daf67938a4f5ca7b6513afb19c18d.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78142RIDYdd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4015446892243775
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7S6x9BcsqyTvRqjsV:SbFuFyLVIg1BG+f+Mm6DKmTv8jLkGq
MD5:	76FBB5AD9B36970F318C843825D88CC8
SHA1:	AA155FA6F86BE150C80DB737B26BE65829FB453F
SHA-256:	E58A8131FC629CC9F582DF3676BECAECA6C6513C2B5223FE4A157FFEB746AAD4
SHA-512:	322DEE2B668E0BD54BF99DAFDBB40CDF77A9A57338EE7DBA6F8707C90A38E5AC33EF1879C8B75DDD0AEA078BDB1A7174F5B36344E0A16595B67BAAF2804C95E3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=11598ec3285746139551659879dadda6.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:782802zH7Ua

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.43654432332881
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8BTGA6RBlsAxxsjsV:SbFuFyLVIg1BG+f+M8BunVqjZcHcljX+
MD5:	490E0B4259DAE46AB5CD0C6AA05135DE
SHA1:	6E30564AE8BC77A7963288402A4D8B3319AA1076
SHA-256:	4D6456C02E297B52153A909644D09EC76AFC79CA9F68CB2EEC1781783B670C15
SHA-512:	A1F6A883A2373265CB51B68ADFBA4CB4B5EF7DF1CEA23C7E95E16C5A416B5DC031D89995464A0CC65E0F61A950AF90A64250F953850DD253B3518E5DB8D44564
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6d68aed93c6d4d47a7dd17459753a91c.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78325uC3Hua

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.420538011115154
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4ZXSgR/V7Vglsjs2ALl:SbFuFyLVIg1BAf+M4pxtV7FjNALyAZD
MD5:	7A32F6E3854FCAAD94220FAA9B100512
SHA1:	4E73193698048D1FE1B712C7635B31EDA51AE361
SHA-256:	5E2497061B14F986082C71677F2C6A2330870667615F6B420DD39AD3EF3DD568
SHA-512:	622DB9D3F7155C76A6F6A99A4C0C40E3B2C809DE47820CDD952D40EBE1C261C6A920A05498EC74D01C0A15A69D54B502F8A66F4F158618E7E1ABAABD52C0C39F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=22e80a27f40e4258b1b0960ae6e49051.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78386EQv7Ma

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392486409902806
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4wECNd9zWD1cyXsje:SbFuFyLVIg1BG+f+M4wECMl8jdCLKzK
MD5:	30A0280EAECB27F8AA9C5C40F97875E0
SHA1:	457A0249624636D9DBBB052CE1BE4C31F48F13C6
SHA-256:	058CD80BB9FDA9EC18C571D1D5087FE19D642E05436767BA80AE5C211EAB05C0
SHA-512:	C5D5F89551CDB4F8B80065882B59155DEBF3509F90A203FE34B66687441A9FCB0DD83EEEC758A38AAF4777C63D23AD2F703299A59724075DF605008C9318595A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=21a63a1156d8493f97f3fe59a8f762a2.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79192dYjvca

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.445609510817564
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9i0kKSDA33FhTjs2BbM:SbFuFyLVIg1BAf+Mo0IDG/jNdQIeXD
MD5:	D894BE1DA5B35114644242947C11EB48
SHA1:	9597E737C0A07AD9427ADE4A508D9357ADA6319C
SHA-256:	D3924B1E9BE7C973443CCDD8A8F1332437A34FBFA917A5AC36398E0293755BC0
SHA-512:	F16FFF913376B7C2AF4EE8E95D3C357BF0EC48CAAF6FCE6FD569AF3507B997D28A2A2EB2B62C8BF0AD4D519032941D04E4D990512F72B4105683FEB743FAFF25
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=74a2d7d78bde4b308d99e6c3de7e5a04.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79383vPqPAb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.428023744621049
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4EwUA813vRqjosQu:qgFq6g10+f+M418H4Qu
MD5:	2C82D790B1246ADC43DA62C77BB363B6
SHA1:	18E8093780E7705262706C861E44492129947209
SHA-256:	9BD0D1541212B938F05AEBD3D6A974AA5C6BA91326FD7B8A84060C076DE36682
SHA-512:	A57EDF36DD6CE639B6A2FC98184D0E6EE79002DAE44674D2276392F74856D86A7FC1336E5423D03AB1F8B24B1F334712CB248B0F9E804831E834BCA41D8BCC0D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2801b519f681471fa0ee71834a1f22ce.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79806nLDkP0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.54920338855389
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm69DEUg4hDaEU4os2p:SbFuFyLVIg1BG+f+M6hEUGEU18ji4s
MD5:	15CB98524B08A3E4BA18021E443D4546
SHA1:	EBBE702A9DD4984E4E5D462675434058C8D4A778
SHA-256:	3DDAE85A6D1CB53F1F8F7100430FA97865C972188DDE2C2083FE11CB746A055A
SHA-512:	C8A615E13E816F0218171983519FDD39CFDC071F4EA60A79F6567B001A6BD0ED3BED4D265D295704AD61F93C81B614A0F936F715776DDB463415318D81F315B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a1fa10b74964bf78c176d1f985e6852.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79807Xrbw60

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.462784813275823
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8OIWdRSYuqjZcHcljX+:qgFq6g10+f+M8OrdRtukmAu
MD5:	8EF1950A2EA89A1F910270C6A7FED8EF
SHA1:	AB668FDC057A830951D4978BC10FF00864E0881B
SHA-256:	AD36F4C1BD04AD56A15E4B5BEE7C77AA36A0C49C147686B3E61C8B0E3059F333
SHA-512:	D422A4D8D3EBAA5F313CADD00AB850205AC7E2E1382A4DBDE9067C4035FE53163B3838862E33046A004DFF7818F1C2CEF0B0154454EDF74FCC5A5902BD76F917
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6129e1744e89474383186d701cb81cee.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79815lwIjb2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.38111848693838
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm52USKzEUTQ2jsmNzi:SbFuFyLVIg1BG+f+MAU1oUTHjdCLKzK
MD5:	595165DABA20BC2EF9C072C9DAA714F1
SHA1:	5E710A956E6374E5995A20FF2ADD0ED23B2C45B5
SHA-256:	856962460E4E867A9EE8591FE4E29DC8379FB90D8E123AB8C3223C3E6440699E
SHA-512:	5D1CDCAD6503CB491AD704F4ED7EFC14A0B638DC96EAA5AD27972A60112A2DDDD6B4B6768DAB4B3C95CF639377F73A7558E6FABE11EF0A920F0FF5EE1278BBFE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=37ac45d7d8f741f0a9b1a165fa475ec5.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79821pSAKBY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.447472206210242
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9NToQcWMVKxsjs1Ha:SbFuFyLVIg1BG+f+MpcWMVKqjosQu
MD5:	7F74C9054D9883492D01A6F1CEC9E423
SHA1:	D67DC64F13EE6E17F162DCB7E71D458B8306476A
SHA-256:	B1BB5C191829BC19871E27180C2C176C6D81C74697A33BAD881E983B2B84F7B8
SHA-512:	D898B26C432BA036B335A626F1D730797BF7C0D8C2A881E9CF006A4E42B7C295BA3F55A852326823E9D3F86A67A4380CA886F1FF78924022F33577A71B979EA9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b91ac6763d7488592af13d1f926e0d1.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79827psxzuZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3710229798705456
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GxWX7RKQVAcEjswK:SbFuFyLVIg1BG+f+M4XrRKvjLkGq
MD5:	129CD624BB2BCB9E05DB6092B7A52528
SHA1:	4DC96F4B0B4F7C4951F90621F6E23FC51FD38E74
SHA-256:	D07C64F851B2A84B8D20A958C4CCCD9298FF1E176069BCEE76464E00AC160876
SHA-512:	5765524C9C21DE0A1367EFAC2553135C422C36ED197A059F9E466BD3D621A0D96822C8464E13D25F24D54A3558E8905B7173C27CE23A6ACE3D142C599C8C3E75
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2ca28732044e42fcaf50c4557e73c3b7.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:798368Tspb1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.514515776475371
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuhScRdhMADvGW7F2+:SbFuFyLVIg1BG+f+MuEcRdeWx2ji4s
MD5:	349C2CED8C059047C1C2C873BDD4BBC7
SHA1:	734F82380D58EB1F8FB7A183E880435FC665FA01
SHA-256:	3B19460EAC59A2587EC75CF175A355AD26ED2C606AD92265A4D6BF63DCBFBC2E
SHA-512:	5858A4BA651D05C5232C4429A67E0EB4D1833888E033D4D928421085F2387F8EDBCE744057AC372EF6E19F801B9A210C0627581A36265E5AB511B401FF98296A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ddc17f3b34384b95883defac8adb57b7.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79837cbdN4X

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.424126215204977
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8EpAenZVm9sMqjs2ALl:SbFuFyLVIg1BAf+M8EpAUmOZjNALyAZD
MD5:	2AD53DA1771801770CEFD2CF097B6DE6
SHA1:	6457E23B2A9A5DE1DB983208CB56ED1639182FC4
SHA-256:	C7D6E5DBDC242B56DCAB505998CDF5D5B88FFA3524A54191A8217487752AE11A
SHA-512:	1849941118CA86B1281D0F36EDB887F136BCE69D17C9A99F59E4063F6078AC5BD71837ED252370CB08CBCBE8996B33E710EF52DA1117AB8A4D319A3395C51C27
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=654ab06ae89046b2b1e0d9b55bd6ff08.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80222bfx5q1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.367784763500337
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuHRvHxzVDEPsjs2BZZD:SbFuFyLVIg1BAf+MuHRvHxzVDEUjNTZD
MD5:	3FA0D216A521DE93EB2BBFFBAFA126FF
SHA1:	CED335DC17F8564DE115F34035151C5711431236
SHA-256:	0DB7D7A504C7AA92C0E8F9CA9D6FD1914B1A3390D2F57F90B58907DF9CD39FCC
SHA-512:	89BF609CCB914F77551A3EFDEA61353AF9E7D15F3C7281E1CF86DA2C533F78FBFBAD71D3BB03A1D66E5E62D73EF6BBACB69203641A74409A75AAF6E88F804CEC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dcde191984b343c0adbd9c45ff980fab.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80316EkvAKZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.414833490124305
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MynbARZDjLTTIWTIL:qgFq6g10+f+MkbARREWEL
MD5:	03573DBFEB32DADF0AD4F44B66F7241C
SHA1:	101C748238453CA482E4903527CE4EF2BC98EEB3
SHA-256:	4B25ED5A6D11A8B118427F273A2D34837138A8664E0D0CB1AD1BA870E1C5C6B8
SHA-512:	C29FEE388D4C2371CF47828024546E3B88BCD848F08702230D8629037F77BACF0D2FBAAFD48B681340EF2FC62985D8A2DA5297CFF6A5C2CCF90B13841DE21260
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8c24ba87591141119cbdbc8c254b215c.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:80334ufdhS1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.37592796533559
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmueUARRch9RWh0h+s4:SbFuFyLVIg1BG+f+MuURRczwKjbVC
MD5:	92CEBDC38425FCE2526FB673BA7DFF4C
SHA1:	D41877EF3FFDC5A02292C7EDF696B5131F1ACFFC
SHA-256:	1DD32F802629C3EB0FC767B72FC167DB9C42519F2C71CEBC907FC19220D329BA
SHA-512:	F623EBB91DD2BBF62C54EB217FDF80DC523DAEB7A152240AFFF2321549ADF4B774A8E05EE7527E81DC4370699ED5B2304436403D95A9BEC67969B9573DA42E6A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d116e13d041c4246899c481a6195a3d2.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80359RQo9W0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.42770127298239
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm8EB2HRTQoAy2jsz:SbFuFyLVK6g7/+BG+f+M8DcoF2jNq
MD5:	F8D4D6E9E9C3023CED064E974D1B94C0
SHA1:	912EC3A52558C99C0691230472705F324B18D93D
SHA-256:	BDB35D96F92F4E97CCDA8FBDBEEE5C76D613AACAC1C8E61B3E9ADCAD15935A59
SHA-512:	A1286A2B959F1AA320A4A4846CE7604EC4A6246E367C42DCFAE02D0DE9BDD55BD00D67D629F1C465DB3A4340F195E126B19125B7E6FBB49B7F772BCBE189A0B6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6a763887c09b46518d3620d891ee3945.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80361PRnDWX

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.41680026262817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4Z0+BNxV0/oWcNI:SbFuFyLVI6g7/+BG+f+M4K+DKoWb8jNq
MD5:	D3962EDCF7119C2B1947FFBCA1E87003
SHA1:	A3DC7655FC06B100E7D39899BB53B77A117BE111
SHA-256:	3C85B3660C7B729919A98A3BA8A2D1867DB4E15681F790DE6F4DD2CDE15406EB
SHA-512:	9AEC598D4D2DF1640B0867CE4FB9B29F7A46B813DE2E4F44E55A74E197854F2B46F13B829155A67FE284F043F18C5C30BFCF5CE8CCFF82AC289872EABD1BA1FC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26002301d11b405bb6fb389d383928af.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80391amQCuY

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.508600827996175
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MC0AQcPWyjFQMzKaBu:qgFqo6g7/+0+f+MfAQ8WwTmh
MD5:	5D647C6C3A20EE38D77F38F1AA01C06E
SHA1:	CBECC9BA627DCA60F23CCF3CF9E0D7929A546E1E
SHA-256:	5E463AEDBE6F68A262CF8DFC3021269B4A9272B098D690F2BEEA03FB9F71CADD
SHA-512:	6E285119EA5E5CDD45197A65BD0A8336650191CB95F342DB564815CBE9C013406EE80127AAA9E6F5D283695162B5FA9934FD1C12B5DC665EB5F995A742880258
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7bf98f6b5de54e63baa401e53e6cb07c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:80392Kg05rZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.496556423172458
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MuGSSr0jFQMzKaBu:qgFqdg7/+0+f+MBSDTmh
MD5:	5C33DA3EF38CC049EACA5EDD75E2F8FA
SHA1:	83207730E830249291C67AF1B1B87CE90E96786F
SHA-256:	6C44BD25146B782ACFEE7467959457D9686C12EC14B5B8D04C1CBD700D870D13
SHA-512:	3B4AA9B2960BB0417526011A3823673D490F6CC41DF4D5BED4AA27711F78C7C4A76C57FEC9ED673891FF390DD345995E89FD61AC76EA4EB4FEA45680FCA9BBB0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d64a3f1c94ce4efbaa261e1c7f9cb09e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:80810MNaO4Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.438240610941895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/2HduRlpQRQlsjsjF:SbFuFyLVIg1BG+f+MeglpQm2jNE
MD5:	8F7AD8E51C1159BB074AB6E80A03BDB1
SHA1:	570D3F8EDCC377E16C35D0D0472C36E0E689F35F
SHA-256:	8FDC8FEBA5AB3C15AA10504246BED8650D29E055C7B689E49EB3A56E0B980D4F
SHA-512:	D45E279340CA4917104DB84EBCF2CB7B7CD7BB9AE7176929AECE3A74896FD424F71F4DAB23482E5EA675692CCAD7E725F6497AC4175760D53ACDE66AEA17F9DE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=59b774860544403587a906730992354c.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:80939r7seWZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4910002716386845
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6GG9RITyL42lsjs2BbM:SbFuFyLVIg1BAf+M6GGQyLB2jNdQIeXD
MD5:	C7C10D26F85E7E94597EBC3BA8FF3D76
SHA1:	AFB9289522389CA6CE4C751FA55C59C30E1964AB
SHA-256:	06A84F93CDD78BDDC38B190057679879196BA9443F9A7726D025578A015166B3
SHA-512:	1CED5F6CDC69BEA3110AF92ECEE50FFC1B793D9A93C5FE3768A06771AE118ED47622F5A36276A0741ABDBCB61A0E8E003A20284D237E7496D9938E4B74D9F66D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0ccdcc26b8d04795861e21e94f551f63.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:812788pPs0Y

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.352931673293832
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm51EWjAWueYATjs1Ha:SbFuFyLVIg1BG+f+MHEWjzueY8joa
MD5:	7614A3EFFC35D79348A297D7AC8F49D0
SHA1:	EA3EAF14AE8DE4F809C7B8B32A0A581FA2D8A730
SHA-256:	9EB1FC55CAAF2EC0FFEDEEF43821E1C3DD76340E0A3B8F03A380B0C8B2DE3946
SHA-512:	98B9FDC3D73DE0FF0C212CE69EB49754D365C71809AC1CF43A97AF05E1EE076B0CE0994505E307C94528341E1DA7BC2426DA432473A3A3375B5A9A36BDB64747
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=30c13ab70239452d93bd0935b8707aef.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:813213jU740

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.322371546184555
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4eEFBOlSvXsjshQJT:SbFuFyLVIg1BG+f+M4b7OtjtWL0
MD5:	7842C3519A862CFB90009731854D6566
SHA1:	B6B988A42602883AC3FAA3C1B92DDEC4A0203A9E
SHA-256:	32BD9437F3A86ABC89484F828A84C298AE46127005C3D4FC7123E4A1602ECBDD
SHA-512:	B6912327FC46D2A1F2553B2E63991F50D40C91DC57B7057E63E0C9972DD84B94611132024272E0B45A2FA8BFE4F2A65C34E77E59F5530932CBA4A3A9A458ED6C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=29a86dbd564a4eaea2c0ed1249c25882.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:81883C5jxik

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.526506554524201
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvP7WnmWXAKFrqjs77:SbFuFyLVIg1BG+f+M37WnmWXAKRqji4s
MD5:	AFAE0D9126A53AE6C358673E63768951
SHA1:	98F86EF6DE5FDDDEAC1EBFE77F6B2C4998D1DA44
SHA-256:	BFDC4C3F3EEC0608AF2B6422BDA06F0AF864E5364646C14C68FE487E97FA4AB1
SHA-512:	02ECCD89E9ACAA8C89C66154C4656751290A5778B9801ED268A5FB4E13DDD5A42E68B0BC87E63C44689B615409E6F1B48E9F7022B48EA90FEC06F27AEE0D9D05
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e62fb0714a68493c99fce709281486ee.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81884o2WO9j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.41504204426726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8GDSZERGTLfcTEfZd:SbFuFyLVIg1BG+f+M8wKLqEhjosQu
MD5:	E48F1B87C3AD6376D0D516A7936D5F4E
SHA1:	284680AA173A3154471EDC6E872EBB1F6822B8B4
SHA-256:	5C91AA256F8B34E91B1E0AC87EF229CD58CB372F3949B70EFC2A8E01B69CF1D5
SHA-512:	BE34AD0EFE4511DF4CA96223A2D47E9CE9FE6B818BAB170F1F63C65652C2B15C62EDC21CB58E9ACC813F96903BBDEC27C741AAF258C9DAE26B7274ACAB5A85D2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c53789c53544c4684bab4e10cb96a14.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81885NpMDVk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.49209563607449
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MIIQBBAqjZcHcljX+:qgFq6g10+f+MIIOBAkmAu
MD5:	C67D2D07D97A69AFA960EAA806DAC8B2
SHA1:	48AAA887FFCA4AD201969AEEB6320C7540BCD731
SHA-256:	82523DFEA9873EFC71B15D6324F302E65A7EB57B6ACFFCD8FE61A6F20EB7DA2C
SHA-512:	784F0862E4AF32C5823A064E7FC2C36617D0AD9C0640DC4F6DF54BCB5F46126598D1877A29ABE8CEC7D93DDAC8ACD06E436EE58BB7021A5AAE40BDDF3A7A96DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=532e54498c414da48c291cfcf672008c.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81892gAsCBm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.387785900149499
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsgceclCs22jdCLKzK:qgFq6g10+f+MsZeccuCLAK
MD5:	2B09716E29956D6E0A06F1B3BDD5ECC0
SHA1:	FB3A1F1B0E0DE8B13C8D443D42C299E75B706624
SHA-256:	CA09377F89295774954FA95192FF75911786722F5C597B523DBF1B227B28E31D
SHA-512:	BF449F7CC3D087DFCBC3AEF1E232EBF0514EDFE6CA0CD4609C939D7E3F10DB9A00EED14EAF264D6CDFE787A0895AFE7D17992DF2F3CECE337E00A3111642444A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f9491081af074ab2b8b672baa8b6d16f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81899e9HWPj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4024047398481985
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuyTaSTG+ARGvAglsd:SbFuFyLVIg1BG+f+MuKB+3g2josQu
MD5:	F1D70AE172E653BEC586983F3E76A971
SHA1:	DEA8A2D161A92481F2FA5704CE2688546EEEF919
SHA-256:	AECD1DAC7952CFBDD31FE5CBC22AF707EBF31C1164FCF9C7D398B7D99DB7DB53
SHA-512:	E5AA70A8A1C70FE5AB82E86620456C99C3D97E169F64701AD2C98716B3FD29F0ED1E2F5750C70C4767712D9853E499E1A4FAD6B23973B64877A990C835BF4C43
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de606fc76c964ed7ab3c7ebfc1a24323.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:819008H0uUm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.386423309283383
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MVjKRMXg32jdCLKzK:qgFq6g10+f+MVjdXgsCLAK
MD5:	5D13851DD8FE44A79DF5CD5F75321F95
SHA1:	7F19142C16A18BC13C336036BE12AA198573B2EB
SHA-256:	B539738A723DCDCDDD56C8ED1FA54FE1ED9B928F5170628F9F06E3066FFA71C8
SHA-512:	01A65085B0781E712C85B2C8673767E9C5E091D473BB2DAD97DED8C792F2B3097EB0205526BA7F5177D22FF6DE7731FF764E2F4B9BCF5ECCF3483F138E1C55F1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e2aabc1b70884829b7a949629877dc36.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81906ent2Ui

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.411035883700517
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6tQVkQddEAvEe5oTD:SbFuFyLVIg1BG+f+M6tbGdEAaX2jLkGq
MD5:	723A5D47C3AF6868EF63CB1C0B1FFEDC
SHA1:	CA133991CC1650F457277AC94E44A83DBFF852C3
SHA-256:	1331332EB8CB323DEF273A2575B8A01076331B54ABC2EDBA5DC79CEBCED2EAF1
SHA-512:	E020253647524662E44AFBC0A3CF4E33EA7F3FB26972D53660B235701FBAFF4CC4CC8398F7B16DF0FE1AE735A80B2230CFC4CC43ACF52145D3C12E6E4C583ABD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=06fc3f50d75641aa8d91cba67e9c9960.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:81914JFZXqm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.404526010536944
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuk8RxAdmGGswsjs2ALl:SbFuFyLVIg1BAf+Muk8nnGG8jNALyAZD
MD5:	CE0E62FFAAB305D2ED28ECE44C630526
SHA1:	7B831EF2DAC6AB2B0B53CC3B43D07BD02BDDB7C8
SHA-256:	20B1F8BC2A45E606253A4D5DBC9A70292DDA0C7FC4693AB1E2D64E2C33302D75
SHA-512:	EE909B2705AFCE018BBD31386439F9E92AEE0CE4E0455C02B9F94D4929539B4106B41877E89086BA5E0FD8E2F341E0EC139EAB6376EC44548EE9D138BFC8A358
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc6ebf3744c3442eaaea459b40a68bca.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81920FByXFi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.50829684397352
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6EBi/WkTFiZjs7Lbr:SbFuFyLVIg1BG+f+M6EBi/WhZji4s
MD5:	EBBB21D02367E2642C9E021CF971AFE2
SHA1:	28AC0CA6D131C2976E4C10383967647B8DA4BEEC
SHA-256:	2754BC0ED211E5B9F8B3928DF2C24723273BD9CF3B44ED20A90101EDF74A9D12
SHA-512:	E835A6D9A776BFA8A202458E3B208966BB234DBA399261C8D4E834D8DB8F9D80461F8542EFB236A1DD397D76A97D09D340CF6EE61188910C0F79A7BCBC23C962
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=018cb1ce9a874ef093dd45f6550e5ac8.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:82913dMVLjl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4355194885065234
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9445u2D9Zj0hglsje:SbFuFyLVIg1BG+f+Mi4VN2jZcHBrt
MD5:	487AD3B66AC6398CE110C6AC3668E062
SHA1:	0976FCFD4C2F256861CFE67782B15D200C493DFB
SHA-256:	BC8CDD02CFFEBDC10997A500ADCC80EE09B747AA05BBED9D910A4FA0B4932A10
SHA-512:	985628284E291662DC6206A0E481877270B5B77A4B5BD2683D3E604E387749617378F49B082CA879A25348E5F371BC2F287974A83145C759395324FDE1056358
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=70747c253f3b4229a18b2afb64003cd0.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:82924XIjMBj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.53337829712889
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MMgXhlTBjFQMzKaBu:qgFqo6g7/+0+f+MMgRJTmh
MD5:	C81F7784DE75A27DA29F268CD9D8B477
SHA1:	209D657487B52825F5A94621E22DDE3189DEAC1A
SHA-256:	E80D9EA767FD80D4D68F49CCFD8F02E90B9FFDA9144B88EB74DBDB8ADF83852D
SHA-512:	0CDE85FDE9C32D87A89C1B722FCF506B9C99494D8A54789DEBDC06F6E06912E2CF0A02CA9CDDF1F0A33CE9E71BD96361CABABE822FFE800685F700DAEF1F9A50
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e8159310c1114782b093bd6caf10693f.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:82925DWpfHi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5010129091187485
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MUk7GDgW40jFQMzKaBu:qgFqdg7/+0+f+ML7GDgW4+Tmh
MD5:	BCBE904F22BD9FBEAAA65533875FA38D
SHA1:	3D310AFF01ED04CB3D6943977C8767B0E39EC26B
SHA-256:	90BA96F985D77622AC7373F5F0B0344BE6E6D56753237A9D56EA9EF2912F2F10
SHA-512:	513BF19A559F8B2DA26DC853F359F79D2B6B54E6F6828CA5A67D6A2806F8382BD547306A0786693F8E024CA4E5A6B4379D8FE556417F6F8208F399AAEE107C5C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7e4b5fc700534ece8d21154440b6dae8.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:829459iP4Jk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.450838909148181
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+kB2ck6UGCNrxsjs2BI:SbFuFyLVIg1BAf+M+kB2Tf0jNdQIeXD
MD5:	E7D93EA7268875557D9C270554530B91
SHA1:	C8C75A9DABDD743D7F87575928C3B58C18444496
SHA-256:	6ACCB2C9C9040EAF28B746951F63968B427003ECD31092D89A3EECC165413E5F
SHA-512:	FF5C21FABB775F2608F166A9EF0112B13622AFCF7F3439B98833BAB712A9F5EAFC47B0BD203E044FE32B2AFFB1656639FA0638E675D18C6EA59DE222EC6C123D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=493d5eb13cb34d0e883517ad1be71c52.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:830205Bi3Rm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.365205303289397
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsGECA77dI3g2lsjs2BP:SbFuFyLVIg1BAf+MsG7k7u2jNTZD
MD5:	FD3649E7D8C7E09736C80FC37CFA1542
SHA1:	CE0A6E7C176D8C9FBB19A12FC2D1AF645FAE7842
SHA-256:	8435923DF0ABC927CD87A4A2DE7A07D7BE7BC3C88EEF589B417AE7995336B50F
SHA-512:	8F221BE30684AAC7E06645D202B8FB0466A14AB5A0031875D81198F4D9C44774C5E0D42CA491E41AB1DBC12B4CC8FCE105D958E1212A471CD70C56A8862B7221
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f2cda0ca3fe048bd8d35de4b273f3d21.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:83031WwSxFl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.460139893233061
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6ptkDU1hg2jLTTIWTIL:qgFq6g10+f+MsODMpEWEL
MD5:	C7DBEEE08BC5C6DA80D37F5621132E4D
SHA1:	9F6EAEA6629659659EB9D9B1A1F58991DAABC0FF
SHA-256:	7318A67F9B2D36522507FBC22734D1CB71FE52D32D6FDBE4BABD418BA56ABFFB
SHA-512:	CAF6635C168018493B4FC491A2301FC7DA91193596D751A3DBC673D4891189BDE25C06F660C78BF38957CAF2B952F49D0F7C86989394071ECAF502CA288A1F2C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=09c124c0bba64d1b9b79f7f086728648.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:831266k4J4i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.386249320950779
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+My2HgAhT7xw30jbVC:qgFq6g10+f+MLHgKtw31
MD5:	27C856B90484801F707772B22E68FFCB
SHA1:	483D7BD9A577765868DAD16E84C19BBF511BF6D9
SHA-256:	D40D26BE7C8A038DE4C19373766452516742B09AB82FBE1F9C6573EC81CECAB5
SHA-512:	63EFF66CCDA3C51C436A45E783D5F2D9AA12E7924A0FE2AED67A4847AA8BF9BF721CDC471E07B4F9C0A77D8B119FB63AC7A21739BE8FF451BBC280206303B102
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=809b44f90ef44b99b6f719edc3b9dcaf.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:83171ry8iEi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.433871880766338
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4Tz0S+gGGX7BTJr:SbFuFyLVK6g7/+BG+f+M4EBgRrBT6jNq
MD5:	2778C1C8D59DA61F4A63C762607BF811
SHA1:	F946B245BA97AE875CA48B68EC6C83B1EA1F9E9B
SHA-256:	E400B5E8DD92403CB74B9D37D01977CB0A1755912DD4F0DD3B09FABE4A292821
SHA-512:	10C67004567B2928A2B1FACE8C9D366665727CA4A10663A7DAFED92D4561372DDC51B9D93415823821734C4E66BD11FDFF24E1D8D36A8A558D27B448C438D258
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=22bf40b171c34ccc8ae0ee985b3ad7c4.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:83173BMB08l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.40131539078892
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsgIr2EsCaysqjsz:SbFuFyLVI6g7/+BG+f+MsgIqXTqjNq
MD5:	84D625F25D75FC49CA0E94373135C0A0
SHA1:	C641FACF39516FCF397EC1215A9BA3F6F852DDCE
SHA-256:	60135DD7F35C7295CDDCF554CBBFE44F865DCC857FA03676F1A0AA9707B46832
SHA-512:	9E51FE500B2FE1518B069F2EB04A542DC49332935124A482161EFE0E757E2AE32F30FBB17655F84B9F7849BCCD3F613240D75B46728A3892A3A3C88FB6310AB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f65d076448b445a99dec408257a966b5.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:84061cTyZJl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.380437088659194
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyZLjHH9VtTjsicWmT:SbFuFyLVIg1BG+f+MyB9bjZcHjv
MD5:	11298EE6175F588B5F298B5519426513
SHA1:	B015C2278801CBD908942F183063AB3D0563BC84
SHA-256:	CF4029348A9A0CB0019F0A3E31CDB42A7A36A2ECB914CDD78BD7ABA36264800C
SHA-512:	BB933C46E4EB33C07E86B473BC3FEE87418D5374C3B3AE690A0E17C6A400EABBD3CEFFC6116699741F70A6B9FC1B137DADD761A18F8B43E1A7095F0E79A41FBA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8e3b45f17db745af91dbf95750446af6.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:84066lG04uk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.34946507772605
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyxcgGcQpNUR1jshQJ:SbFuFyLVIg1BG+f+MyxcgGcQQR1jtWL0
MD5:	A7B06BE870CC632C33347AE0D747BE1D
SHA1:	3F3C67A09A8BFA49C5B5D4427861D1656B30BC9B
SHA-256:	1B71F7E726377FAEBF5460FA0F86EC671D4D478EE0058B8B3A77BD5F19E6BF4F
SHA-512:	D8D1CEFE8A241CC22981574245F2BCAD1A90B04CB146BD8E5B54168F70BAAB4FDC5BAED5467F41794F59A64219BB27F86153EB1FA25FD2165326841C6E2A8CD2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8a363d85a599491ba95ea88361cf2d54.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:84072Axu2Ij

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.427487444290812
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvtESIhX35qjsjOdlE:SbFuFyLVIg1BG+f+MeajNE
MD5:	13ED095FC91D407541543AC9228D4E9E
SHA1:	BAB072D8C46C0EA51B2CB96D42A80C705FD18117
SHA-256:	4A9507E03490C131A2227262C5F42227C98526B8693E632435558047E763FBA0
SHA-512:	8C34B1B772A8AFC1D44F8EC3F4BFB4ECD8AAEE474BA6996691EF1BAB0FA28C05E62C8F1931E7E71000025B3DC953338A981AC45581385A14CCBE26C63810E735
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e7eda5a8331c46cfb0692dac293a92d4.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:8412967yg8i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.36458497965827
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9XjN3NGrQVvswsjs4:SbFuFyLVIg1BG+f+Mtf5v8joa
MD5:	A824D31E96691537C36F8837901C5EC8
SHA1:	139C74AF7980F3947A7FF1BFBC9D3D26CC1092BD
SHA-256:	BDA1A2669938546FDD4650E20E75A09535B34A974C8B9FE89D9D33E361F0DE7B
SHA-512:	A0DB8A744B7A1DEA73FE57333B6204EDACDDC3B7AEFAD43C4FE764A2A40D8BA4E1211C5826C4CF4D58E226C23D200A4449A900B0C4D8169DCFB0DC6EDB8CE071
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d08dbff422b4992845000d5b33650fa.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat01ax7uQ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat01okSCf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0C0Gl2T

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0CI8n5d

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0T23q6m

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0noSHCe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1274xBuhd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.327556609685745
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgHd7ch91bvpo206qodpnRv:SbFuFyL3BVgdL87iesnAiRJgHdmHxotc
MD5:	98C7BEB9F0B41FEA9C3D6AC3B11A43D9
SHA1:	1E5581A0AF5522CE8BEE65D8ED0B6821CD1C6766
SHA-256:	BD2C4FB4F913B895611869CA42AA98FC88B0FF7C68A72BEB6065FF7279FFB14D
SHA-512:	6C450BC68F8789CA449073F61675754A767AE1E82A99D22BA043429C6EADF016703679B9DE305256B8C600002D3DF0C0E8437DE43EE80DFD9962450FCEE82852
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1732244383042988.MONOTONIC=529205486.LAST_SESSION_TIMESTAMP=529310218.

/run/systemd/users/.#127GlMhLT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4850108043159596
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8l7gHIrWit6jLSo:qgFq30dABibBE5gHIr5Ijmo
MD5:	C1324869F072F261AC3DF8F84C16A21D
SHA1:	88E07D5217E4B0FADACC59188DF50616289C35EC
SHA-256:	26806F63D129EED2BD487E6C9E9C5E190653377A4FEF7197E5D9BFB4E3F7ABA8
SHA-512:	7B88BDAF7BD9FA8FBE8907EEF44BF7320401ED99D8B0CC523BB7F8692930D14C06EFEFB72BFA356FB36DE12654F47665A9AF467E191F3C7F22E2BF12F73E6F6A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14493.REALTIME=1732244440447109.MONOTONIC=586609606.LAST_SESSION_TIMESTAMP=586771773.

/run/systemd/users/.#127N0bxbQ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3295595725914735
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgH3V3M/9cZO2xi206qodjNLSo:SbFuFyL3BVgdL87iesnAiRJgHIrWit6d
MD5:	516A04F66B729BE9BCE6AFF918306E91
SHA1:	B58825F22DEF45EBCA84535D799555B4E65C847B
SHA-256:	7D7527D768015AF0643252D07A387A7E0C0F9D1A80823B359B9AE2C7F0E3509A
SHA-512:	3FFD49E7433BB2D78461F6182C1DCE232AB3C3A272849C71950B60083930812FE882754234BA9E90BAF81E0C7DE60066D57B9DFBD623878F79E02BB4EF6A19A5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1732244440447109.MONOTONIC=586609606.LAST_SESSION_TIMESTAMP=586771773.

/run/systemd/users/.#127NimYKS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127gCNrFS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293544436915218
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8AgHIAf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEAgHIAethQHtPYq9M
MD5:	6C2513119186438064FF4203FFC5936A
SHA1:	6C01BD3B7FCDBEDAB90C30C957D33D7CC5622069
SHA-256:	195D9B1C66C9F6DEB9CDB0EE703C68942FF50B164589C7B3FEF1DF45D6E51F39
SHA-512:	6213DD6CE7448221F7D78B8BDB1DC3F24232E7F75EEB486F18B69E63C861588459D1E1204E587688D8704F331E933FB7DB90503BFF79338A048686EFD1CA877C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14311.REALTIME=1732244440447109.MONOTONIC=586609606.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127hbGgBf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.313667032804251
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxfflCgHdmH12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBdCgHdg8thQHtPYq9M
MD5:	8C1CDB0805EC868BF6C869648932C9A9
SHA1:	A5CE58449066E44654809EBC77B23FD139C4F9B6
SHA-256:	4720AAA853BD3D4BF97E8B653EB02E3BC71EF6DB1FEEB29908F92FCA06C72C7F
SHA-512:	3506079A14BC010BC9FDDCB5067D82749FA3808927683239FA38010749B5DB6EE1B75D2A1FA11F701915B5CD35875BECE466AEDF9CFB23A8C590BC7174EB5684
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13513.REALTIME=1732244383042988.MONOTONIC=529205486.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127lKvyWb

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.486948936627751
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffWJgHdmHxot6/J:qgFq30dABibBOJgHdgOIB
MD5:	187E6CC090BCCB792D9EDB80A25D0A02
SHA1:	FC3EDE778FF96529621A8D0578F97F89B6C0B0A1
SHA-256:	721FBAE78DCEAE4A722F5B61A0954C49B3493EACCF684528E83BD8AAF4960E08
SHA-512:	CA85338EEE07A956598338A4128F0684443F73205EB8E5CC4436301268F7E683F79EF6340FB08016E2FBA6344F403BBD2FF7D601467370ADE64B2D1CEF697F10
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13575.REALTIME=1732244383042988.MONOTONIC=529205486.LAST_SESSION_TIMESTAMP=529310218.

/run/systemd/users/.#127npF7RT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293544436915218
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8AgHIAf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEAgHIAethQHtPYq9M
MD5:	6C2513119186438064FF4203FFC5936A
SHA1:	6C01BD3B7FCDBEDAB90C30C957D33D7CC5622069
SHA-256:	195D9B1C66C9F6DEB9CDB0EE703C68942FF50B164589C7B3FEF1DF45D6E51F39
SHA-512:	6213DD6CE7448221F7D78B8BDB1DC3F24232E7F75EEB486F18B69E63C861588459D1E1204E587688D8704F331E933FB7DB90503BFF79338A048686EFD1CA877C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14311.REALTIME=1732244440447109.MONOTONIC=586609606.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127q8Rsoc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.313667032804251
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxfflCgHdmH12thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBdCgHdg8thQHtPYq9M
MD5:	8C1CDB0805EC868BF6C869648932C9A9
SHA1:	A5CE58449066E44654809EBC77B23FD139C4F9B6
SHA-256:	4720AAA853BD3D4BF97E8B653EB02E3BC71EF6DB1FEEB29908F92FCA06C72C7F
SHA-512:	3506079A14BC010BC9FDDCB5067D82749FA3808927683239FA38010749B5DB6EE1B75D2A1FA11F701915B5CD35875BECE466AEDF9CFB23A8C590BC7174EB5684
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13513.REALTIME=1732244383042988.MONOTONIC=529205486.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sb3zDR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4850108043159596
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8l7gHIrWit6jLSo:qgFq30dABibBE5gHIr5Ijmo
MD5:	C1324869F072F261AC3DF8F84C16A21D
SHA1:	88E07D5217E4B0FADACC59188DF50616289C35EC
SHA-256:	26806F63D129EED2BD487E6C9E9C5E190653377A4FEF7197E5D9BFB4E3F7ABA8
SHA-512:	7B88BDAF7BD9FA8FBE8907EEF44BF7320401ED99D8B0CC523BB7F8692930D14C06EFEFB72BFA356FB36DE12654F47665A9AF467E191F3C7F22E2BF12F73E6F6A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14493.REALTIME=1732244440447109.MONOTONIC=586609606.LAST_SESSION_TIMESTAMP=586771773.

/run/systemd/users/.#127tg557b

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:zn:zn
MD5:	86EA52E2957DC514D833DAAEF9F00545
SHA1:	0BBEBB9C85409CA9760D6A2CD64B83B336040078
SHA-256:	B60A3E2D4EB6D7C22CF38B96FA41E308F5C337B82B85C0CCAFE85EA10EEC7BB6
SHA-512:	2483F75B7545C72C625E05E68616235E0BA6FBFB8ED24A4F4EC965BD48E72EE718D4223C4619A3C6D9C173BE107FFB2C20C4F4CDADCD69DA197D1A1DFECF25DF
Malicious:	false
Preview:	6499.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mR2:m8
MD5:	1F6D12DD61B5C7523F038A7B966413D9
SHA1:	31186E88EC0FC9A52399CB0C08232397A5EA6B0F
SHA-256:	B136656F536F16870D86F21702AC178C294978B1B20C0DB1AA75D30B99DFBAE2
SHA-512:	CFBDBDCCE9A4FB1C23476862D5F4EDC4DD8D3CEE19205A3F9231FB87FF9DD16503810D17129228B4D115960648BA9243DBD155664AD3B1907FA2962DD0896C9B
Malicious:	false
Preview:	7041.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:5lR0sXlXEWtl//jx/:b+ylV
MD5:	A3B2CD6663CC015B181DFAF5209CB094
SHA1:	E51475CCC383D67F35F69A5A8E8CD463DC4C8329
SHA-256:	D63F3CC222407E102BDF1BD395E384423DB5842BC979160DC862BAEB0703B577
SHA-512:	7384E2A930531A006F494CEF23EFBCCF49024DB5EFCA8B556B1B636FC18EBD9370EC82922AEC5DBC188AAA02B85360A825AEB1A926F1593D7461B75E2595662D
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................?g.3......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mRe:mE
MD5:	28B746016F14D01D853B212D40AF1CC8
SHA1:	3316F63FC3ACF575949C528CD3E3EC82B13857B1
SHA-256:	1A7FC4C4CE210C43CD552ECCBB5580E729F4E82EA8F9CA7C2441AEF4CBF9A46E
SHA-512:	7A2096BABF5144912FF99D1E70952B8CB59B4C5C29D0E1FBCA6F632978AE973AEAD5D2DE960125F7D8A64DE902A5EAA7FB8CDB808B45E83127695182DBFE17DC
Malicious:	false
Preview:	7049.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mRF:mD
MD5:	D7B09C2B11F9BE441BAD4D1A9BFF7614
SHA1:	A490F4346472610DDA52E73FC0902A99AB80766C
SHA-256:	755A00D9FF71AD8F649825E456EE2C55E95EA4721A38EE9109238B07233363D1
SHA-512:	45284E424C1EB2DEF21E41AF7234908C998BF252DD3571597F99552A8C6C25D1080A454C7ADFB59FA47BD59688DAEE50A7F354F1676C907227C650F1D04AE81E
Malicious:	false
Preview:	7040.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:mXoUv:m42
MD5:	E285090156C0EC4D25560EA0E71683D4
SHA1:	5974898E9FC916CFC93A4E891B40EDB276EC0EFC
SHA-256:	DB2638AC881754B0D99064C87EACC36A156CC4FE24EF8D729E2545967AD6F6D9
SHA-512:	999BD30342658425A40E92A49A9D84379901354B4F00ED214184AC2258B7B9118272470948FA1396967FFECC572C7B4E60004837298C722628D36F8D9F31DFE7
Malicious:	false
Preview:	7023.7024.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mR2:m8
MD5:	1F6D12DD61B5C7523F038A7B966413D9
SHA1:	31186E88EC0FC9A52399CB0C08232397A5EA6B0F
SHA-256:	B136656F536F16870D86F21702AC178C294978B1B20C0DB1AA75D30B99DFBAE2
SHA-512:	CFBDBDCCE9A4FB1C23476862D5F4EDC4DD8D3CEE19205A3F9231FB87FF9DD16503810D17129228B4D115960648BA9243DBD155664AD3B1907FA2962DD0896C9B
Malicious:	false
Preview:	7041.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mRe:mE
MD5:	28B746016F14D01D853B212D40AF1CC8
SHA1:	3316F63FC3ACF575949C528CD3E3EC82B13857B1
SHA-256:	1A7FC4C4CE210C43CD552ECCBB5580E729F4E82EA8F9CA7C2441AEF4CBF9A46E
SHA-512:	7A2096BABF5144912FF99D1E70952B8CB59B4C5C29D0E1FBCA6F632978AE973AEAD5D2DE960125F7D8A64DE902A5EAA7FB8CDB808B45E83127695182DBFE17DC
Malicious:	false
Preview:	7049.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mRF:mD
MD5:	D7B09C2B11F9BE441BAD4D1A9BFF7614
SHA1:	A490F4346472610DDA52E73FC0902A99AB80766C
SHA-256:	755A00D9FF71AD8F649825E456EE2C55E95EA4721A38EE9109238B07233363D1
SHA-512:	45284E424C1EB2DEF21E41AF7234908C998BF252DD3571597F99552A8C6C25D1080A454C7ADFB59FA47BD59688DAEE50A7F354F1676C907227C650F1D04AE81E
Malicious:	false
Preview:	7040.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:mXoUv:m42
MD5:	E285090156C0EC4D25560EA0E71683D4
SHA1:	5974898E9FC916CFC93A4E891B40EDB276EC0EFC
SHA-256:	DB2638AC881754B0D99064C87EACC36A156CC4FE24EF8D729E2545967AD6F6D9
SHA-512:	999BD30342658425A40E92A49A9D84379901354B4F00ED214184AC2258B7B9118272470948FA1396967FFECC572C7B4E60004837298C722628D36F8D9F31DFE7
Malicious:	false
Preview:	7023.7024.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mR2:m8
MD5:	1F6D12DD61B5C7523F038A7B966413D9
SHA1:	31186E88EC0FC9A52399CB0C08232397A5EA6B0F
SHA-256:	B136656F536F16870D86F21702AC178C294978B1B20C0DB1AA75D30B99DFBAE2
SHA-512:	CFBDBDCCE9A4FB1C23476862D5F4EDC4DD8D3CEE19205A3F9231FB87FF9DD16503810D17129228B4D115960648BA9243DBD155664AD3B1907FA2962DD0896C9B
Malicious:	false
Preview:	7041.

/tmp/qemu-open.gTYa1K (deleted)

Download File

Process:	/tmp/vkjqpc.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	4.132944044980959
Encrypted:	false
SSDEEP:	3:Tg/7iHJN:Tg/wJN
MD5:	197BCCF731891065F42C5F8301BFA07F
SHA1:	45D451E38611D4006F8A93D166EA73FF516EC6AA
SHA-256:	36A45510BB19E2EED7BA25FE72D9DE27FD3252BABC31B555EC633727518D3251
SHA-512:	6EFCD3FCCE0D2386033884E9DDB044A8723384DB6A7B846D03D8557FA13CDBB7D865F18F0BD50BFBD2FA5338B2C8C3FC97853F2C35879E2ECADE1BA3F85F938C
Malicious:	false
Preview:	/tmp/vkjqpc.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.1F6LX2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.4TS6W2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.OVT7W2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	4.874151163993838
Encrypted:	false
SSDEEP:	24:sFZeEwrgwPoQLRAAv6RAA2+ViBI8jjV0pYrwfJrwEK8:bXv6XfVrYrErl
MD5:	364EE5D8E661A92F1819E8D58F52AF6E
SHA1:	48FA3BB9D0D0F8657DBC075D1A20A99522A47392
SHA-256:	2BC3C26F654B644828740F879833A184114A42C840D0F57FA5239A49344AA7FE
SHA-512:	917741843E2AE4C57E1CF9836F002075FDC61375A9C5A341FF445D41C68EE4114614256EF8847E9EDD44C1402821B4554B10F33E3D65F95BFCEF13D9F81BF26A
Malicious:	false
Preview:	Nov 21 21:00:26 galassia systemd-logind[6899]: Failed to add user by file name 1000, ignoring: Invalid argument.Nov 21 21:00:26 galassia systemd-logind[6899]: User enumeration failed: Invalid argument.Nov 21 21:00:26 galassia systemd-logind[6899]: User of session 2 not known..Nov 21 21:00:26 galassia systemd-logind[6899]: Session enumeration failed: No such file or directory.Nov 21 21:00:26 galassia systemd-logind[6899]: Watching system buttons on /dev/input/event0 (Power Button).Nov 21 21:00:26 galassia systemd-logind[6899]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Nov 21 21:00:26 galassia systemd-logind[6899]: New seat seat0..Nov 21 21:00:40 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Nov 21 21:00:40 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Nov 21 21:00:40 galassia systemd-logind[6899]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31Hlf+9qbc+t3+9qbc+l//:F3P+9gcK+9gc+l/
MD5:	A6C1B835AAD7310B75AE1C5F60B31DB6
SHA1:	E813C3C54EF87DF3196EB9F7F22D77B359349092
SHA-256:	E071921C21937F240E1B7495D6B8F8B7DAEF40979D8B4F34B4DC7F33FC468BDA
SHA-512:	A2CEE41F08415E686729C557C76368D122232E0A20A25EE6BD3FD860001C0F987F839BDB73F9B494E31792AE2DB73A4D1B0DEB67C497621E26AF0153EF5E4888
Malicious:	false
Preview:	LPKSHHRH.................9a...E...~..i.M.................................9a...E...~..i.M........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31HlYDx6/0wt2Dx6/0wdt:F3o0zt20zd
MD5:	269FCB035B3144DB9478EB5DAE5CD1A5
SHA1:	82E88BF28F68C59392D337E12EE020D87B67C3FA
SHA-256:	FC76ABE9C9C8B927DDDAD2441C419E300468CD95AEE90C7B3833D90402E94A1C
SHA-512:	F705EF2B087E7E1B6A000FB35755DFB0416FC3AF6ED9E26BE7B5F4A32362B0383533EF6631EABD20F6A3786BB270832BAD4EE5E2D3B3F4184E7C54F32FF236C2
Malicious:	false
Preview:	LPKSHHRH..................h..L..V......................................h..L..V............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12149
Entropy (8bit):	4.961649726932964
Encrypted:	false
SSDEEP:	96:UjtFOnQihC3Qtub1qjt+rUZFQCKLpCzqNG3f/gdsI5xUBTEQOiU5nWOr8MIiYw6W:UjZi9KJKXhUzr8IPUdDSAdnG
MD5:	AA9B87D4F9BFBD7C9D81D4A42D56D168
SHA1:	8E695FCEC086FFCD5002D8C5962EDE8A80D38BE0
SHA-256:	05D72C4998FCAD105E1AF5C160A2796C229AE4968A44D86E1A0D06C32976AB69
SHA-512:	1D959F2AAC9C1C2034A9E878684DBDBFD8079DB2C59FA30974490ADA4F306C22FF6988C2C63961688B157969865F6F83BEB2D12A929953D176B232767D9916C0
Malicious:	false
Preview:	Nov 21 21:00:19 galassia kernel: [ 563.629308] blocking signal 9: 6240 -> 658.Nov 21 21:00:19 galassia kernel: [ 563.638581] blocking signal 9: 6240 -> 720.Nov 21 21:00:19 galassia kernel: [ 563.683677] blocking signal 9: 6240 -> 772.Nov 21 21:00:19 galassia kernel: [ 563.702143] blocking signal 9: 6240 -> 936.Nov 21 21:00:19 galassia kernel: [ 563.708610] blocking signal 9: 6240 -> 2048.Nov 21 21:00:19 galassia kernel: [ 564.940268] New task spawned: old: (tgid 6960, tid 6960), new (tgid: 6960, tid: 6965).Nov 21 21:00:19 galassia kernel: [ 564.941794] New task spawned: old: (tgid 6960, tid 6960), new (tgid: 6960, tid: 6966).Nov 21 21:00:19 galassia kernel: [ 564.963130] New task spawned: old: (tgid 6960, tid 6966), new (tgid: 6960, tid: 6967).Nov 21 21:00:19 galassia kernel: [ 565.091186] New task spawned: old: (tgid 6964, tid 6964), new (tgid: 6968, tid: 6968).Nov 21 21:00:19 galassia kernel: [ 565.186068] New task spawned: old: (tgid 6968, tid 6968), new (tgid: 6969, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	32816
Entropy (8bit):	5.112468142017938
Encrypted:	false
SSDEEP:	768:lXUfgMyWgMy/xOC8wCWU/NC5tPwWDXTlrUi3y7GMI+Skgy9f7pmcQar:lkjoUj
MD5:	05807326D514B0F603FF13211E6571B7
SHA1:	56710B19C4C44FB70FB4AD9EECF546BF7E1D7073
SHA-256:	180C1DF64CAEA424E83A1C49003EE0CB7FA8D9DD83D129AB0A641EA51F29B48C
SHA-512:	E8AABC965B9A7D59D162595BEC55989C712D17F13FE4E27D04E8766212318FD7B093807102F2C371C70E2A476584DE32640A0AB7CA614B161031BB405C0D9793
Malicious:	false
Preview:	Nov 21 21:00:19 galassia kernel: [ 563.502756] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Nov 21 21:00:19 galassia kernel: [ 563.502860] systemd[1]: rsyslog.service: Failed with result 'signal'..Nov 21 21:00:19 galassia kernel: [ 563.511363] systemd[1]: getty@tty2.service: Succeeded..Nov 21 21:00:19 galassia kernel: [ 563.513456] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Nov 21 21:00:19 galassia kernel: [ 563.513462] systemd[1]: dbus.service: Failed with result 'signal'..Nov 21 21:00:19 galassia kernel: [ 563.514694] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 4..Nov 21 21:00:19 galassia kernel: [ 563.515730] systemd[1]: Started D-Bus System Message Bus..Nov 21 21:00:19 galassia kernel: [ 563.518592] systemd[1]: Stopped Getty on tty2..Nov 21 21:00:19 galassia kernel: [ 563.519521] systemd[1]: Started Getty on tty2..Nov 21 21:00:19 galassia kernel: [ 563.519810] systemd[1]: whoop

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:5lR0sXlXEWtl//jx/:b+ylV
MD5:	A3B2CD6663CC015B181DFAF5209CB094
SHA1:	E51475CCC383D67F35F69A5A8E8CD463DC4C8329
SHA-256:	D63F3CC222407E102BDF1BD395E384423DB5842BC979160DC862BAEB0703B577
SHA-512:	7384E2A930531A006F494CEF23EFBCCF49024DB5EFCA8B556B1B636FC18EBD9370EC82922AEC5DBC188AAA02B85360A825AEB1A926F1593D7461B75E2595662D
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................?g.3......................................

Source: vkjqpc.elf	ReversingLabs: Detection: 50%
Source: vkjqpc.elf	Virustotal: Detection: 39%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:49662 -> 154.216.16.109:33966

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.772850990639252
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	vkjqpc.elf
File size:	162'760 bytes
MD5:	5c577c051d86c9e78be3278fe982f98b
SHA1:	7bb1697b41891de5a6007811d9bcbe23f69b21a6
SHA256:	3e4410cf69e2a10499aa4c2e5ffb72e909783cb9aa5fb76fab7d709454625b8c
SHA512:	bbd92575697a1000eb2ebc42221feff5d94418d0d6160a730dfd339c01eb0e6ade8f3e369a40acea9f74dc54c2b3d01f8d5b5e29c2e65d62229b710a94ff698d
SSDEEP:	1536:40JstkmPiLuhx8WpSnUKLkpobxY1VOTuU4+Zr57I6h/jk16vAVAKkOmBsTcwq8Nt:40Jufh+TZdbxA/ZA57Vh0jV2VnTc
TLSH:	BAF33B06730C0907D1632EB43A3F67E183EF99D121E4F644695FAB4A91B2E371586ECE
File Content Preview:	.ELF...........................4..y......4. ...(....................../.../...............0...0...0...Il...X........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........zx..../...@..\?.....0D.+../...A..$8...})....0DN..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	162240
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x1fb1c	0x0	0x6	AX	4
.fini	PROGBITS	0x1001fbd4	0x1fbd4	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1001fbf8	0x1fbf8	0x33fc	0x0	0x2	A	8
.ctors	PROGBITS	0x10033000	0x23000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x1003300c	0x2300c	0x8	0x0	0x3	WA	4
.got2	PROGBITS	0x10033018	0x23018	0xc	0x0	0x3	WA	1
.data	PROGBITS	0x10033040	0x23040	0x48a0	0x0	0x3	WA	32
.sdata	PROGBITS	0x100378e0	0x278e0	0x8c	0x0	0x3	WA	4
.sbss	NOBITS	0x1003796c	0x2796c	0x108	0x0	0x3	WA	4
.bss	NOBITS	0x10037a78	0x2796c	0x44e0	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x2796c	0x51	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x22ff4	0x22ff4	6.2359	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x23000	0x10033000	0x10033000	0x496c	0x8f58	0.4673	0x6	RW	0x10000	.ctors .dtors .got2 .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 22, 2024 03:57:53.196048975 CET	33218	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:53.556854963 CET	53	33218	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:53.559679031 CET	40382	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:53.681929111 CET	53	40382	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:53.684478998 CET	39275	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:53.806890011 CET	53	39275	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:53.809191942 CET	54977	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:53.932872057 CET	53	54977	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:53.934881926 CET	55962	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:54.057444096 CET	53	55962	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:54.061033964 CET	58611	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:54.183501005 CET	53	58611	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:55.651690960 CET	53788	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:55.773845911 CET	53	53788	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:55.774851084 CET	49272	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:55.897233009 CET	53	49272	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:55.898299932 CET	55530	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.020693064 CET	53	55530	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:56.021713972 CET	46263	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.144121885 CET	53	46263	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:56.145132065 CET	55195	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.267450094 CET	53	55195	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:56.269292116 CET	36229	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.391684055 CET	53	36229	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:56.393414974 CET	60567	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.515755892 CET	53	60567	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:56.517759085 CET	42991	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.641102076 CET	53	42991	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:56.642600060 CET	51367	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.765068054 CET	53	51367	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:56.766510963 CET	56179	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:56.890826941 CET	53	56179	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:58.360161066 CET	32794	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:58.482400894 CET	53	32794	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:58.484828949 CET	49488	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:58.607228994 CET	53	49488	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:58.609683037 CET	34341	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:58.732084036 CET	53	34341	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:58.734386921 CET	32819	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:58.856947899 CET	53	32819	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:58.859611034 CET	37340	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:58.982088089 CET	53	37340	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:58.985126019 CET	55830	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:59.107439041 CET	53	55830	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:59.110649109 CET	44232	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:59.233000994 CET	53	44232	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:59.235228062 CET	48183	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:59.357563019 CET	53	48183	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:59.359203100 CET	38947	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:59.633944035 CET	53	38947	8.8.8.8	192.168.2.23
Nov 22, 2024 03:57:59.634996891 CET	50946	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:57:59.757112026 CET	53	50946	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:22.848949909 CET	33963	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:22.971538067 CET	53	33963	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:22.973911047 CET	54807	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:23.096843004 CET	53	54807	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:23.099006891 CET	41278	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:23.221971035 CET	53	41278	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:23.224061966 CET	58335	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:23.346616983 CET	53	58335	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:23.348893881 CET	49803	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:23.715456009 CET	53	49803	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:23.718007088 CET	55088	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:23.840768099 CET	53	55088	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:23.843544006 CET	50199	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:23.965995073 CET	53	50199	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:23.968167067 CET	52509	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:24.090568066 CET	53	52509	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:24.093543053 CET	39835	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:24.216226101 CET	53	39835	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:24.218765974 CET	36699	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:24.340991020 CET	53	36699	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:34.865025043 CET	57903	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:34.987904072 CET	53	57903	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:34.990197897 CET	42557	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.113276005 CET	53	42557	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.115606070 CET	34874	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.238188028 CET	53	34874	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.239824057 CET	32819	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.362777948 CET	53	32819	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.364475965 CET	38965	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.486845970 CET	53	38965	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.488735914 CET	58714	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.611426115 CET	53	58714	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.613791943 CET	41101	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.736354113 CET	53	41101	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.738800049 CET	35951	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.861221075 CET	53	35951	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.862958908 CET	53005	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:35.985364914 CET	53	53005	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:35.987731934 CET	37026	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:36.110338926 CET	53	37026	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:37.630381107 CET	58865	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:37.753076077 CET	53	58865	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:37.755484104 CET	43813	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:37.878148079 CET	53	43813	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:37.880333900 CET	60603	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.003022909 CET	53	60603	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:38.004614115 CET	38957	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.127309084 CET	53	38957	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:38.129091024 CET	48778	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.251722097 CET	53	48778	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:38.254009008 CET	42771	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.376730919 CET	53	42771	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:38.379551888 CET	50631	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.502276897 CET	53	50631	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:38.504992008 CET	58342	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.628120899 CET	53	58342	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:38.631082058 CET	57931	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.754036903 CET	53	57931	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:38.757575989 CET	46581	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:58:38.882158041 CET	53	46581	8.8.8.8	192.168.2.23
Nov 22, 2024 03:58:44.815886021 CET	44630	53	192.168.2.23	1.1.1.1
Nov 22, 2024 03:58:44.815886974 CET	52411	53	192.168.2.23	1.1.1.1
Nov 22, 2024 03:58:45.036199093 CET	53	52411	1.1.1.1	192.168.2.23
Nov 22, 2024 03:58:45.041480064 CET	53	44630	1.1.1.1	192.168.2.23
Nov 22, 2024 03:58:45.727673054 CET	36834	53	192.168.2.23	1.1.1.1
Nov 22, 2024 03:58:45.865998983 CET	53	36834	1.1.1.1	192.168.2.23
Nov 22, 2024 03:59:01.940481901 CET	38213	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.062901020 CET	53	38213	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.063788891 CET	60527	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.186151028 CET	53	60527	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.186956882 CET	42176	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.309165001 CET	53	42176	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.310023069 CET	58536	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.432501078 CET	53	58536	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.433470011 CET	40056	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.555843115 CET	53	40056	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.556873083 CET	53913	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.679310083 CET	53	53913	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.680644989 CET	45789	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.802925110 CET	53	45789	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.805035114 CET	47076	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:02.927347898 CET	53	47076	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:02.930036068 CET	52344	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:03.052261114 CET	53	52344	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:03.053210974 CET	33425	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:03.175369978 CET	53	33425	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:09.196450949 CET	47325	53	192.168.2.23	1.1.1.1
Nov 22, 2024 03:59:09.334952116 CET	53	47325	1.1.1.1	192.168.2.23
Nov 22, 2024 03:59:17.546380043 CET	58419	53	192.168.2.23	1.1.1.1
Nov 22, 2024 03:59:17.684587955 CET	53	58419	1.1.1.1	192.168.2.23
Nov 22, 2024 03:59:24.850198030 CET	59568	53	192.168.2.23	1.1.1.1
Nov 22, 2024 03:59:24.989538908 CET	53	59568	1.1.1.1	192.168.2.23
Nov 22, 2024 03:59:26.337603092 CET	59706	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:26.460140944 CET	53	59706	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:26.463749886 CET	58827	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:26.586113930 CET	53	58827	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:26.590394020 CET	38718	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:26.712733984 CET	53	38718	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:26.716371059 CET	39716	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:26.838635921 CET	53	39716	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:26.843025923 CET	38096	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:26.965423107 CET	53	38096	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:26.969475985 CET	48389	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:27.092003107 CET	53	48389	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:27.095953941 CET	36145	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:27.218214989 CET	53	36145	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:27.224013090 CET	56169	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:27.346322060 CET	53	56169	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:27.353003025 CET	33117	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:27.475224018 CET	53	33117	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:27.482290030 CET	55831	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:27.604613066 CET	53	55831	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:50.674525976 CET	52046	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:50.796853065 CET	53	52046	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:50.797596931 CET	38224	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:50.920908928 CET	53	38224	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:50.921761990 CET	43746	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.044233084 CET	53	43746	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:51.045274973 CET	33780	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.167643070 CET	53	33780	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:51.168482065 CET	46303	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.290738106 CET	53	46303	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:51.291594982 CET	49124	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.413855076 CET	53	49124	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:51.414659977 CET	44563	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.536900043 CET	53	44563	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:51.537555933 CET	41272	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.660841942 CET	53	41272	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:51.661744118 CET	44098	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.784048080 CET	53	44098	8.8.8.8	192.168.2.23
Nov 22, 2024 03:59:51.784885883 CET	48633	53	192.168.2.23	8.8.8.8
Nov 22, 2024 03:59:51.907346010 CET	53	48633	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.034940958 CET	33807	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:15.157231092 CET	53	33807	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.158328056 CET	57229	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:15.280705929 CET	53	57229	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.281738997 CET	51311	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:15.405368090 CET	53	51311	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.406054020 CET	40564	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:15.528290033 CET	53	40564	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.528930902 CET	45448	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:15.651067019 CET	53	45448	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.652153015 CET	52396	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:15.774408102 CET	53	52396	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.775203943 CET	37888	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:15.897355080 CET	53	37888	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:15.898072958 CET	56205	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:16.021512985 CET	53	56205	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:16.022197962 CET	48627	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:16.144390106 CET	53	48627	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:16.145087957 CET	60821	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:16.267350912 CET	53	60821	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:22.094779968 CET	56957	53	192.168.2.23	1.1.1.1
Nov 22, 2024 04:00:22.094779968 CET	44828	53	192.168.2.23	1.1.1.1
Nov 22, 2024 04:00:22.234215975 CET	53	44828	1.1.1.1	192.168.2.23
Nov 22, 2024 04:00:22.319446087 CET	53	56957	1.1.1.1	192.168.2.23
Nov 22, 2024 04:00:39.369060040 CET	57680	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:39.491311073 CET	53	57680	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:39.493707895 CET	59883	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:39.616096020 CET	53	59883	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:39.619124889 CET	46328	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:39.741414070 CET	53	46328	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:39.748269081 CET	50395	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:39.870538950 CET	53	50395	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:39.872812033 CET	42295	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:39.995116949 CET	53	42295	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:39.997582912 CET	35470	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:40.119879007 CET	53	35470	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:40.122133017 CET	39076	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:40.244365931 CET	53	39076	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:40.246709108 CET	58148	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:40.368910074 CET	53	58148	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:40.371927023 CET	60612	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:40.494057894 CET	53	60612	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:40.496578932 CET	52161	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:40.618810892 CET	53	52161	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:42.133728981 CET	47418	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:42.255945921 CET	53	47418	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:42.259529114 CET	32921	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:42.381778955 CET	53	32921	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:42.385390043 CET	55291	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:42.508095980 CET	53	55291	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:42.511303902 CET	42559	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:42.633546114 CET	53	42559	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:42.637602091 CET	52677	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:42.759860992 CET	53	52677	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:42.763020039 CET	40698	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:42.885293961 CET	53	40698	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:42.891884089 CET	60641	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:43.014116049 CET	53	60641	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:43.017457008 CET	34125	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:43.139765024 CET	53	34125	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:43.144654036 CET	56226	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:43.266825914 CET	53	56226	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:43.271533966 CET	51161	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:43.393712997 CET	53	51161	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:44.874176025 CET	43746	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:44.996413946 CET	53	43746	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:44.998733997 CET	56876	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:45.120985031 CET	53	56876	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:45.123394012 CET	44075	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:45.245604992 CET	53	44075	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:45.248030901 CET	39451	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:45.370286942 CET	53	39451	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:45.372416973 CET	36120	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:45.494697094 CET	53	36120	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:45.497663975 CET	47755	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:45.619826078 CET	53	47755	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:45.623280048 CET	33860	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:45.768913984 CET	53	33860	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:45.772280931 CET	60411	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:45.894411087 CET	53	60411	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:45.898097038 CET	38097	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:46.020343065 CET	53	38097	8.8.8.8	192.168.2.23
Nov 22, 2024 04:00:46.022059917 CET	55413	53	192.168.2.23	8.8.8.8
Nov 22, 2024 04:00:46.144329071 CET	53	55413	8.8.8.8	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 22, 2024 03:58:41.962568998 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Nov 22, 2024 04:00:01.973047018 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-11-22 02:58:51 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-11-22 02:58:52 UTC	25	IN	HTTP/1.1 100 Continue
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-11-22 02:58:52 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-11-22 02:58:53 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Fri, 22 Nov 2024 02:58:53 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	02:57:52
Start date (UTC):	22/11/2024
Path:	/tmp/vkjqpc.elf
Arguments:	/tmp/vkjqpc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	02:57:54
Start date (UTC):	22/11/2024
Path:	/tmp/vkjqpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	02:59:23
Start date (UTC):	22/11/2024
Path:	/tmp/vkjqpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	02:57:53
Start date (UTC):	22/11/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	02:58:35
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:58:37
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:58:40
Start date (UTC):	22/11/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	02:58:41
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:58:42
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:58:43
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:58:44
Start date (UTC):	22/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vkjqpc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6873/oom_score_adj

/proc/7033/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75703Ccg7x9

/run/systemd/journal/streams/.#9:75718hYkbGb

/run/systemd/journal/streams/.#9:76023qdZKjc

/run/systemd/journal/streams/.#9:76026LdebEc

/run/systemd/journal/streams/.#9:76157EaUxla

/run/systemd/journal/streams/.#9:764247BvMw9

/run/systemd/journal/streams/.#9:764261mY1O9

/run/systemd/journal/streams/.#9:76553lNjp9a

/run/systemd/journal/streams/.#9:76651j4b6zd

/run/systemd/journal/streams/.#9:76658Opsora

/run/systemd/journal/streams/.#9:76670IX8sya

/run/systemd/journal/streams/.#9:76677pJCtOd

/run/systemd/journal/streams/.#9:76756tjufTd

/run/systemd/journal/streams/.#9:778809RweMb

/run/systemd/journal/streams/.#9:77915yj10qb

/run/systemd/journal/streams/.#9:77916zlcAU9

/run/systemd/journal/streams/.#9:77934wCZSC9

/run/systemd/journal/streams/.#9:78130snG7Id

/run/systemd/journal/streams/.#9:78142RIDYdd

/run/systemd/journal/streams/.#9:782802zH7Ua

Linux Analysis Report
vkjqpc.elf

Start time (UTC):	02:58:45
Start date (UTC):	22/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	02:58:46
Start date (UTC):	22/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	02:58:47
Start date (UTC):	22/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	02:58:48
Start date (UTC):	22/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	02:58:49
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:58:50
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:58:51
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:59:01
Start date (UTC):	22/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:59:02
Start date (UTC):	22/11/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	02:59:03
Start date (UTC):	22/11/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f