Edit tour

Linux Analysis Report
dvwkja7.elf

Overview

General Information

Sample name:	dvwkja7.elf
Analysis ID:	1564938
MD5:	b68bdebddddfd9506637eef57ada50c5
SHA1:	cf57bc838388792ffa6eed0d171e7cf59f1b9f0d
SHA256:	b2b7259f28f175afda3273c05113c1855ac1dc9478cdcb3730fd4aa8bb3ddce1
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564938
Start date and time:	2024-11-29 02:36:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	dvwkja7.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/120@143/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/dvwkja7.elf
PID:	6275
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dvwkja7.elf (PID: 6275, Parent: 6199, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/dvwkja7.elf

dvwkja7.elf New Fork (PID: 6277, Parent: 6275)

dvwkja7.elf New Fork (PID: 6279, Parent: 6277)

dvwkja7.elf New Fork (PID: 6281, Parent: 6279)

sh (PID: 6281, Parent: 6279, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6287, Parent: 6281)

ps (PID: 6287, Parent: 6281, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

dvwkja7.elf New Fork (PID: 6517, Parent: 6279)

sh (PID: 6517, Parent: 6279, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6519, Parent: 6517)

ps (PID: 6519, Parent: 6517, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

dvwkja7.elf New Fork (PID: 6626, Parent: 6279)

sh (PID: 6626, Parent: 6279, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6628, Parent: 6626)

ps (PID: 6628, Parent: 6626, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

systemd New Fork (PID: 6324, Parent: 1)

journalctl (PID: 6324, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6339, Parent: 1)

systemd-journald (PID: 6339, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6340, Parent: 1)

journalctl (PID: 6340, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6358, Parent: 1)

dbus-daemon (PID: 6358, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6362, Parent: 1320)

Default (PID: 6362, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6365, Parent: 1320)

Default (PID: 6365, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6366, Parent: 1320)

Default (PID: 6366, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6367, Parent: 1860)

pulseaudio (PID: 6367, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6369, Parent: 1)

rsyslogd (PID: 6369, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6374, Parent: 1)

rtkit-daemon (PID: 6374, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6377, Parent: 1)

systemd-logind (PID: 6377, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6439, Parent: 1)

polkitd (PID: 6439, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6443, Parent: 1)

gpu-manager (PID: 6443, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6444, Parent: 6443)

sh (PID: 6444, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6449, Parent: 6444)

grep (PID: 6449, Parent: 6444, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6450, Parent: 6443)

sh (PID: 6450, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6451, Parent: 6450)

grep (PID: 6451, Parent: 6450, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6452, Parent: 6443)

sh (PID: 6452, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6453, Parent: 6452)

grep (PID: 6453, Parent: 6452, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6454, Parent: 6443)

sh (PID: 6454, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6455, Parent: 6454)

grep (PID: 6455, Parent: 6454, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6456, Parent: 6443)

sh (PID: 6456, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6457, Parent: 6456)

grep (PID: 6457, Parent: 6456, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6458, Parent: 6443)

sh (PID: 6458, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6459, Parent: 6458)

grep (PID: 6459, Parent: 6458, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6460, Parent: 6443)

sh (PID: 6460, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6461, Parent: 6460)

grep (PID: 6461, Parent: 6460, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6462, Parent: 6443)

sh (PID: 6462, Parent: 6443, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6463, Parent: 6462)

grep (PID: 6463, Parent: 6462, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6445, Parent: 1)

agetty (PID: 6445, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6466, Parent: 1)

generate-config (PID: 6466, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6467, Parent: 6466)

pkill (PID: 6467, Parent: 6466, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6468, Parent: 1)

gdm-wait-for-drm (PID: 6468, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

gvfsd-fuse New Fork (PID: 6472, Parent: 2038)

fusermount (PID: 6472, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6478, Parent: 1)

gdm3 (PID: 6478, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6483, Parent: 6478)

plymouth (PID: 6483, Parent: 6478, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6501, Parent: 6478)

gdm-session-worker (PID: 6501, Parent: 6478, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6505, Parent: 6501)

gdm-wayland-session (PID: 6505, Parent: 6501, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6507, Parent: 6505)

dbus-daemon (PID: 6507, Parent: 6505, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6509, Parent: 6507)

dbus-daemon New Fork (PID: 6510, Parent: 6509)

false (PID: 6510, Parent: 6509, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6511, Parent: 6505)

dbus-run-session (PID: 6511, Parent: 6505, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6512, Parent: 6511)

dbus-daemon (PID: 6512, Parent: 6511, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6513, Parent: 6478)

Default (PID: 6513, Parent: 6478, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6514, Parent: 6478)

Default (PID: 6514, Parent: 6478, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6484, Parent: 1)

accounts-daemon (PID: 6484, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6496, Parent: 6484)

language-validate (PID: 6496, Parent: 6484, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6497, Parent: 6496)

language-options (PID: 6497, Parent: 6496, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6498, Parent: 6497)

sh (PID: 6498, Parent: 6497, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6499, Parent: 6498)

locale (PID: 6499, Parent: 6498, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6500, Parent: 6498)

grep (PID: 6500, Parent: 6498, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6540, Parent: 1)

journalctl (PID: 6540, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6541, Parent: 1)

systemd-journald (PID: 6541, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6542, Parent: 1)

dbus-daemon (PID: 6542, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6545, Parent: 1)

rsyslogd (PID: 6545, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6551, Parent: 1)

systemd-logind (PID: 6551, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6609, Parent: 1)

agetty (PID: 6609, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6611, Parent: 1)

gpu-manager (PID: 6611, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6612, Parent: 6611)

sh (PID: 6612, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6613, Parent: 6612)

grep (PID: 6613, Parent: 6612, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6614, Parent: 6611)

sh (PID: 6614, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6615, Parent: 6614)

grep (PID: 6615, Parent: 6614, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6616, Parent: 6611)

sh (PID: 6616, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6617, Parent: 6616)

grep (PID: 6617, Parent: 6616, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6620, Parent: 6611)

sh (PID: 6620, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6621, Parent: 6620)

grep (PID: 6621, Parent: 6620, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6622, Parent: 6611)

sh (PID: 6622, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6623, Parent: 6622)

grep (PID: 6623, Parent: 6622, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6624, Parent: 6611)

sh (PID: 6624, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6625, Parent: 6624)

grep (PID: 6625, Parent: 6624, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6629, Parent: 6611)

sh (PID: 6629, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6630, Parent: 6629)

grep (PID: 6630, Parent: 6629, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6631, Parent: 6611)

sh (PID: 6631, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6632, Parent: 6631)

grep (PID: 6632, Parent: 6631, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6636, Parent: 1)

journalctl (PID: 6636, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6638, Parent: 1)

generate-config (PID: 6638, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6641, Parent: 6638)

pkill (PID: 6641, Parent: 6638, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6642, Parent: 1)

gdm-wait-for-drm (PID: 6642, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6647, Parent: 1)

journalctl (PID: 6647, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6648, Parent: 1)

dbus-daemon (PID: 6648, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6649, Parent: 1)

agetty (PID: 6649, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6652, Parent: 1)

systemd-logind (PID: 6652, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6709, Parent: 1)

rsyslogd (PID: 6709, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6711, Parent: 1)

systemd-journald (PID: 6711, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6718, Parent: 1)

gdm3 (PID: 6718, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6721, Parent: 6718)

plymouth (PID: 6721, Parent: 6718, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6739, Parent: 6718)

gdm-session-worker (PID: 6739, Parent: 6718, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6747, Parent: 6739)

gdm-wayland-session (PID: 6747, Parent: 6739, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6750, Parent: 6747)

dbus-daemon (PID: 6750, Parent: 6747, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6754, Parent: 6750)

dbus-daemon New Fork (PID: 6755, Parent: 6754)

false (PID: 6755, Parent: 6754, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6756, Parent: 6747)

dbus-run-session (PID: 6756, Parent: 6747, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6757, Parent: 6756)

dbus-daemon (PID: 6757, Parent: 6756, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6758, Parent: 6718)

Default (PID: 6758, Parent: 6718, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6759, Parent: 6718)

Default (PID: 6759, Parent: 6718, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6724, Parent: 1)

accounts-daemon (PID: 6724, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6728, Parent: 6724)

language-validate (PID: 6728, Parent: 6724, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6729, Parent: 6728)

language-options (PID: 6729, Parent: 6728, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6730, Parent: 6729)

sh (PID: 6730, Parent: 6729, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6731, Parent: 6730)

locale (PID: 6731, Parent: 6730, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6732, Parent: 6730)

grep (PID: 6732, Parent: 6730, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6733, Parent: 1)

journalctl (PID: 6733, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6735, Parent: 1)

polkitd (PID: 6735, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6743, Parent: 1)

systemd (PID: 6743, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 6748, Parent: 6743)

systemd New Fork (PID: 6751, Parent: 6748)

30-systemd-environment-d-generator (PID: 6751, Parent: 6748, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 6766, Parent: 6743)

systemctl (PID: 6766, Parent: 6743, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 6770, Parent: 6743)

pulseaudio (PID: 6770, Parent: 6743, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6774, Parent: 6743)

dbus-daemon (PID: 6774, Parent: 6743, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6761, Parent: 1860)

dbus-daemon (PID: 6761, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6762, Parent: 1860)

pulseaudio (PID: 6762, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6763, Parent: 1)

rtkit-daemon (PID: 6763, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
dvwkja7.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
dvwkja7.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e05c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e070:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e084:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e098:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e14c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e174:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e188:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e19c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6275.1.00007fd258017000.00007fd258038000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6275.1.00007fd258017000.00007fd258038000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1e048:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e05c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e070:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e084:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e098:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e0fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e110:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e124:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e138:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e14c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e160:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e174:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e188:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e19c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1e1d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: dvwkja7.elf PID: 6275	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: dvwkja7.elf PID: 6275	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15a62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ab2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ada:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b52:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b66:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b7a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15b8e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ba2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bb6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bde:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15bf2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6369)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6545)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6709)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6339)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6478)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6507)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6711)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6718)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6750)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6743)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.197.dr, syslog.38.dr, syslog.137.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 38400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38400
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: dvwkja7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6275.1.00007fd258017000.00007fd258038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: dvwkja7.elf PID: 6275, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4525, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4527, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4537, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4557, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4749, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6112, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6281, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6287, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6339, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6364, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6367, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6374, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6377, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6439, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6445, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6478, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6484, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6517, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6519, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6541, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6542, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6543, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6545, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6551, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6626, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6628, result: no such process	Jump to behavior

Source: dvwkja7.elf

ELF static info symbol of initial sample: __gnu_unwind_execute

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/maps[killer/maps] killed process: %s ;; pid: %d

Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1389, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1463, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1465, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1475, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1476, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1477, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1489, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1494, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1532, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1576, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1579, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1582, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1586, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1594, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1601, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1612, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1622, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1623, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1627, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1629, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1632, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1633, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1638, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1639, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1642, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1648, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1654, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1656, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1661, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1664, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1668, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1698, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4525, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4527, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4537, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4557, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 4749, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6112, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6262, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6281, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6287, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6339, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6358, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6364, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6367, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6374, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6377, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6439, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6445, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6478, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6484, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6517, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6519, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6541, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6542, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6543, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6545, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6551, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6626, result: no such process	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	SIGKILL sent: pid: 6628, result: no such process	Jump to behavior

Source: dvwkja7.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6275.1.00007fd258017000.00007fd258038000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: dvwkja7.elf PID: 6275, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/120@143/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6358)	File: /proc/6358/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6472)	File: /proc/6472/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6507)	File: /proc/6507/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6512)	File: /proc/6512/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6542)	File: /proc/6542/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6648)	File: /proc/6648/mounts
Source: /usr/bin/dbus-daemon (PID: 6750)	File: /proc/6750/mounts
Source: /usr/bin/dbus-daemon (PID: 6774)	File: /proc/6774/mounts
Source: /usr/bin/dbus-daemon (PID: 6761)	File: /proc/6761/mounts

Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:75329VF5RLx	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:75494I5JhSu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76842jHk1dw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76849WPa7Eu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76854xgmxyw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76859FG326x	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76864EDByox	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76471fbJOsu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76472HcWyjx	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76498XJZJDu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76605Z5TUXy	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76675E3YuSx	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:76769MUsnZx	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:767920RReNv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:777306lZ8Sw	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:77759pDqkww	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:77809V4ywPu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:77811tYfFkv	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:78875CkC2Yu	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	File: /run/systemd/journal/streams/.#9:78877nq97Zu	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	File: /run/systemd/seats/.#seat0WBXDJn	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	File: /run/systemd/users/.#127dxwAdp	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	File: /run/systemd/users/.#127r45ndq	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	File: /run/systemd/seats/.#seat030EBCp	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	File: /run/systemd/users/.#127rGxBVm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	File: /run/systemd/users/.#127fDpVuq	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6377)	File: /run/systemd/users/.#1275qxbUp	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6439)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6505)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6484)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6484)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:79565fUvoAP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:79566q3LF0N	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:79574SejQKO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:79583HY1inL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:795920X9WAP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:796677sGnfP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:79748CtOUsM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	File: /run/systemd/journal/streams/.#9:79837JbYpHO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6551)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6551)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6551)	File: /run/systemd/seats/.#seat0rDQgmA	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6652)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6652)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/seats/.#seat0ikYV1c
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/users/.#127CYeWJ9
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/users/.#127YJdzld
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/seats/.#seat0ckBQqd
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/users/.#127PGNptd
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/users/.#127uxhBnc
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/users/.#127lYiigd
Source: /lib/systemd/systemd-logind (PID: 6652)	File: /run/systemd/users/.#1276HhK89
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:80892XtqIUC
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:81925TbNGhF
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:81926VcFRaF
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:819419DmgUF
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:81942SrzTJD
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:81951qWVy4D
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:81952Tg4OpE
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82030UQu9pE
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82122WSqhKC
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82146uByWZD
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82148au4xVC
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82283WsuQsF
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82284dlOI7C
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:822908rbuaE
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82439xT49DD
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:824789zwLWE
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82603L307uC
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82682auwj1F
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82738rxtWFF
Source: /lib/systemd/systemd-journald (PID: 6711)	File: /run/systemd/journal/streams/.#9:82849hKgnPG
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6747)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6724)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6724)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6735)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6743)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6751)	Directory: <invalid fd (4)>/.config

Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/66/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/66/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/99/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/33/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/33/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/222/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/222/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/222/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/333/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/333/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/333/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/777/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/777/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/888/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/888/stat	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/999/cmdline	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6279)	File opened: /proc/999/stat	Jump to behavior
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6770/stat
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6770/cgroup
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6770/cgroup
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6770/comm
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6774/stat
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6774/comm
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6774/cgroup
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/1/environ
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/1/sched
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/1/comm
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6766/comm
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6766/cgroup
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6743/status
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6743/status
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6743/status
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6743/status
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6743/status
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6743/status
Source: /lib/systemd/systemd (PID: 6743)	File opened: /proc/6748/comm
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6770/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6770/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6652/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6762/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6762/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6762/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6763/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6718/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6710/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6710/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6743/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6724/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6735/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6648/status
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6648/attr/current
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6747/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6739/cmdline
Source: /usr/bin/dbus-daemon (PID: 6648)	File opened: /proc/6739/cmdline
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/6232/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/6232/status	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/3088/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	File opened: /proc/231/cmdline	Jump to behavior

Source: /tmp/dvwkja7.elf (PID: 6281)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6517)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/dvwkja7.elf (PID: 6626)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6444)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6450)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6452)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6454)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6456)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6458)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6460)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6462)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6498)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6612)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6614)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6616)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6620)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6622)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6624)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6629)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6631)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6730)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6449)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6451)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6453)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6455)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6457)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6459)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6461)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6463)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6500)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6613)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6615)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6617)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6621)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6623)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6625)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6630)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6632)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6732)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6467)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6641)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6287)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6519)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior
Source: /bin/sh (PID: 6628)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=	Jump to behavior

Source: /lib/systemd/systemd (PID: 6766)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6287)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6519)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6711)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6445)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6609)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6649)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6478)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6478)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6484)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6484)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6718)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6718)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6724)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6724)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6369)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6369)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6443)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6545)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6545)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6611)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6709)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6709)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/dvwkja7.elf (PID: 6277)

File: /tmp/dvwkja7.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6443)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6611)	Truncated file: /var/log/gpu-manager.log			Jump to behavior

Source: /usr/bin/ps (PID: 6287)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6519)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6628)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6367)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6467)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6641)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6770)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6762)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/dvwkja7.elf (PID: 6275)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6339)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6367)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6369)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6443)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6445)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6501)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6541)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6545)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6609)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6611)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6649)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6709)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6711)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6739)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6770)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6762)	Queries kernel information via 'uname':

Source: dvwkja7.elf, 6275.1.00007ffc7b1e7000.00007ffc7b208000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/dvwkja7.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/dvwkja7.elf
Source: dvwkja7.elf, 6275.1.000055a66b24c000.000055a66b39e000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/arm
Source: kern.log.197.dr	Binary or memory string: Nov 28 19:39:37 galassia kernel: [ 583.321369] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: dvwkja7.elf, 6275.1.00007ffc7b1e7000.00007ffc7b208000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.h2nkrH:5Hh
Source: syslog.137.dr	Binary or memory string: Nov 28 19:39:14 galassia kernel: [ 560.002546] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: dvwkja7.elf, 6275.1.000055a66b24c000.000055a66b39e000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: dvwkja7.elf, 6275.1.00007ffc7b1e7000.00007ffc7b208000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: syslog.137.dr	Binary or memory string: Nov 28 19:39:14 galassia kernel: [ 560.002604] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: dvwkja7.elf, 6275.1.00007ffc7b1e7000.00007ffc7b208000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.h2nkrH
Source: kern.log.197.dr	Binary or memory string: Nov 28 19:39:37 galassia kernel: [ 583.321396] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6484)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6724)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dvwkja7.elf, type: SAMPLE
Source: Yara match	File source: 6275.1.00007fd258017000.00007fd258038000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dvwkja7.elf PID: 6275, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dvwkja7.elf, type: SAMPLE
Source: Yara match	File source: 6275.1.00007fd258017000.00007fd258038000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dvwkja7.elf PID: 6275, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 File and Directory Permissions Modification	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Disable or Modify Tools	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
dvwkja7.elf	45%	ReversingLabs	Linux.Backdoor.Mirai
dvwkja7.elf	38%	Virustotal		Browse
dvwkja7.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
raw.cardiacpure.ru	178.215.238.4	true	true	unknown
raw.cardiacpure.ru. [malformed]	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.197.dr, syslog.38.dr, syslog.137.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	true
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	test.elf	Get hash	malicious	Mirai	Browse
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse
89.190.156.145	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	jzyKEkkDsV.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	jwwofba5.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	kjsusa6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	hidakibest.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.mips.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	hidakibest.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	hidakibest.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.24
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	bot.x86_64.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
raw.cardiacpure.ru	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	vkjqpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wriww68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jzyKEkkDsV.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vsbeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wnbw86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	iwir64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	wriww68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	test.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.4
	arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.4
	x32.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.4
	i586.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.4
	arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.4
	m68k.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.4
CANONICAL-ASGB	jwwofba5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	exploitips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	brute.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	go.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	test.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Mozi.m.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	hidakibest.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	91.189.91.42
	hidakibest.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6510/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6755/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Ltn:Bn
MD5:	F4CF6F787A2DD31B517312543123444C
SHA1:	BED7A633DDAC98F2BF2F75090CD8D481F7610CDA
SHA-256:	97A8199C0A7AA362302CCBEAE9D376BBEBD0757B9284D74A9FBFF6D38AB6AF6B
SHA-512:	A15B83C129A8D6A252B0A50663FDCD1E418B69A03B5E86C7519D349F89F45E1EB4D6D8AC3002D509601A24185ABD6E208B7BC23F26B88906E5D258856D41B4DB
Malicious:	false
Preview:	6718.

/run/systemd/journal/streams/.#9:75329VF5RLx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.480391828159511
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsJEsn9Qgfn0X5hgl3:SbFuFyLVIg1BG+f+Msf952/Tji4s
MD5:	50A38697767C8C93BF425808A69C3F4A
SHA1:	0107D96E09BCAC69D714E332532FE79EF1861AF8
SHA-256:	88214D337C8AAE73BF5AD93C690885A255CF691A93BBB4EC3B3DD7056D5DE572
SHA-512:	53A193A201ED264B6CA63F7F52CE7C6E9767C5359041FC955F71C8F46E02DF504DDB1BC0DFE950E4EF2641D78663D775131031D633A711AEA2AE7B821C6EE924
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f15ae40bb4a5458ba8fa25b09ee42b1b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75494I5JhSu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.512245653485789
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+TB6HV2WWfS0Zjs77:SbFuFyLVIg1BG+f+M+N6HVJWfHji4s
MD5:	E54D043160ACAD929C162F1A27331ECC
SHA1:	5FC03D3C43F672E9333E888CB0A986D53B33B667
SHA-256:	99369CE9DADC8BC1A871236A5E0FDBB9932B3A3B7CC40DBBC396B5D0A1D3E496
SHA-512:	99D8A242261A1CF063973978AB6F78A488A1D1CE328CA2C83DECFCF0B9F89A4449D1F37E39A8ED387854776B6C2E4E6763E6E87C8E0CB66C9E6F18F0786AD4EB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=41b27ecd149d49b08fe11a3c288db0a7.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76471fbJOsu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.437328634193927
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvJ9gTVglGAnATzRqO:SbFuFyLVIg1BG+f+MBmT8GA2z8jNE
MD5:	AF552E244AC97DD01E8CBA681980DCC0
SHA1:	2303A2EB8698BE3DA67796CBDBF017A48062DE97
SHA-256:	D46C165D62EA5F57360F23683B61785367F9EAE08D65965B246D9C43F491D548
SHA-512:	F9A5FC091D173B84F819C1C4C9C5C4B0C1F4DA75B967B9DC226BA6223AC5CCE36E2FF5FB62B32203D296B5DFE7C5F93FEFEFE6946B12DD26BAACF5D581FE177B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e466ddbfd768405889c8271ce8e41e6f.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76472HcWyjx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4742089613757186
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8XAtov0jZcHcljX+:qgFq6g10+f+M8XAeimAu
MD5:	8FB16C7EEAA266AF9CF043E5B4ADEF6A
SHA1:	496BB7CAE2A65C7C6D00D590ABC5459CD1B9A25C
SHA-256:	4094DF7A344477B6DC8553AC9615277B56CC329DD35267F7B689A201C397BDE1
SHA-512:	60004E9E850E20490EB6BA6B6DDC3A94D3A43BEC6E3397AA88DE40E62B96B2F75C6B93FB331871C3D94CB30747E77190E3AFF07CF516BC15C4CC089766FBC06E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6c460987e6e84776bfd39d68e2ce283c.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76498XJZJDu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.369854245833949
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6EKdhX36W7sMxsjs1:SbFuFyLVIg1BG+f+M6EKX6W7sMqjbVC
MD5:	354E44A1FBEF2E2DE3256EC1E18D5CDD
SHA1:	8B5EB3B0DE78300D60772436968548AA080A80E1
SHA-256:	1985077989C767A82CC33BB88196408C377BD69B72DB2E98C006275D66773384
SHA-512:	3786034E0FFA90AF86C7B5CA7CE09D947D518D82311864975F042EB340839186119C48910CC602AFB8F81790FA0261C417E641B4AF43F67359749D779936BD0B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0181a1b208484e3389cca1b633c1fcda.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76605Z5TUXy

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.445584488665342
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmodZ5sEvvRqjs2ALAXaN:SbFuFyLVIg1BAf+MozeEsjNALyAZD
MD5:	1F031D4AA31E9B0010CB7CAE914DBFB7
SHA1:	F0F89C5E2F5F6F42CB75B3B14E5C7B35E12CB097
SHA-256:	B8B09821456CBB64B85B9CD16EFA5D8CC284E348F7C5DE25EF87713B6CFECE65
SHA-512:	6110F6D6D5435ACFC8F4A891EEAB34DF90CE48190B7EDA99553D48417FD0EC222DD526FE4B02C8476619196A0725162C6446267006636C57626DF5332F2E7F7D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b64387a61338461293be5f33e099b9c6.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76675E3YuSx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.411074172060203
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mutotz8hF8jNdQIeXD:qgFq6g1af+MzB2D
MD5:	F4B6CA26E063F4D2208C6423149E22A6
SHA1:	7B905F020411E9A05FEC4E906C6676E71258C77F
SHA-256:	869480E2C3F84168B39B0BEE8DE8A876970B79ECFC6B0FD3BB54855F53B83C38
SHA-512:	AD62E5571BFA5B1C5E729E80483FBE21344B852CFDDFAA82D747D905A6F3337C096AE5CBC4E917B86B0190BD7C95475E4DB866776449C6E65A28F16104F99A72
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de3d6bfe80bf4a0ebd83a5e32a9b09e0.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76769MUsnZx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.373859953263734
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzPDGS1mcq53uxsjsV:SbFuFyLVIg1BG+f+MrDGS1mV+qjLkGq
MD5:	0EE1006CA0EAC821021F86C1A1D798A6
SHA1:	25C859B8851B8654964E6701B1D6D47B80EEA494
SHA-256:	8E71ACD85062F46DE7D43F42F64A2B346389DB81101510B67C35F88D3709C409
SHA-512:	46471C9B0376B97E3363F83673763D8502D0C3E758FEF5C4CD9DB9CDD2C6C0179C9B31BF03E2E57DD2B028448319189FCF3A9EEF1EB91FE5E4D6E8F0860ACD2D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=97f317f237a94e99b9ef9c903f83401c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:767920RReNv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.43148214202287
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoKFJERt022jdCt/rRMtq:qgFq6g10+f+MoKnED03CDL
MD5:	CD12465B0B45F09C064BB2285E477B4B
SHA1:	283340899132EBD540C737AA3CA4DE8141E4CC4E
SHA-256:	73795694D611D53CB15D74D9AB205551EE1308BB3B32EA28801117B7EE956403
SHA-512:	2FE645782A6E6355B1E70D03BD835474F27A4BF7AE383FCA31862C839C9D98B25F0C9F850F1FEBF5051A92F0ADB28B4D1B78597604FB445B612C574489DE488C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b56faaf6b5c8405ab66dc78eaa4302d5.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76842jHk1dw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.433478186734813
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoS1WSmVkfPx5N0h+U:SbFuFyLVIg1BG+f+MoS5fbN0ZjosQu
MD5:	2667FDE1BFD50F688836660B2DB8097B
SHA1:	27E2540215DD06EED24052F0FF714FB834C89D87
SHA-256:	55F0523A3122850F8BBC27E9A5FFE50A402DE26541B213E7E934433D3ED41179
SHA-512:	6841093E6D73CD8097047F1C8A62CEF657CC382C30AC92C87FFD1685EC60F46737D8C241B13C63DAF6B431423736D1B76E9FB178FA690527D20A684E55CDB990
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6de463792824f8188800be147e5412b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76849WPa7Eu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.431039842260236
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyZ9O/CZjFmzXvn:qgFqo6g7/+0+f+MIvQXvn
MD5:	557A53860F52DD7C27B79DF1A756E2E0
SHA1:	9422E94C09F945E3E18DA59477F91FF75D6EBB33
SHA-256:	57AC5F8272C017510EDC1F429B30244424708780E9CE0B0FF4F2B4324A7BC1EE
SHA-512:	C725E1F5093DDFFC43DE645CB7B2EC464CB9EA3AB304D03C0B7896FE36E6569C35FE809C9D9FA1B0CFB2C7069568BB115DCC510AAFF66AF6658B9E37DE2C560F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8712c62c8c6d49d9a37b8aa7ca13beb7.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76854xgmxyw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	5.452492312537502
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4mdDu7SSvF2js+M:SbFuFyLVI6g7/+BG+f+M4mQ8jFmzXvn
MD5:	475C7943FA9B1197F9E33EE5E277E863
SHA1:	5589AC5C25A049B9B549CCFCDC6C91239F8654FA
SHA-256:	F37638E96E06130E0B684528399932E706481D3D89A66B3297F8AD157AC3E4F1
SHA-512:	60BDF58C8382795FB897CC9733632C3ED2DE7C871CCCCE56423FBE69DC7E6992C0CCD4262F74D100B1A486D92B5AEB4F0E6A3D40EE38801D9B39F1BE4B4F5B87
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2198de54b64f4e4887975066decf3f77.IDENTIFIER=org.gnome.Shell.desktop.

/run/systemd/journal/streams/.#9:76859FG326x

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.38837702061303
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyGjMQgIRQ2jdCLKzK:qgFq6g10+f+MxCIRlCLAK
MD5:	3B0B149D003D37209485405351C88F7A
SHA1:	DDFA0BF83EF4D64F376B5B897EF4FF652A30F935
SHA-256:	192B533F1E84F6BC776ABB0CB7528C343938D514F896524A96234A3E2F1FB141
SHA-512:	8730EA658868C3521BE219A8C9AFAF0BF0087640AA027BBCFCF3C6EED6EE81226F4A2F2C1F23FBF57C48CF342FD375E7932A3EB4341E278EA349CAF9513863F6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89e175c4a7c64ad394565a99a4f7bb4c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76864EDByox

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3311414424172385
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp/Fa9CRNrqjshQJWQ:SbFuFyLVIg1BG+f+M9FiCj2jtWL0
MD5:	E92E91FAE8E88BBEF09958A70E0A03CE
SHA1:	A6472D1E58CA0A1ADD843AEE3FA41A18BBEE39AF
SHA-256:	4F6AA568BAD402D30966B8A8F02443DC0F84AEA0F52FDBE7CC8B7B2D1FD655D5
SHA-512:	2A36629550A99220C2A56369FE6AB0EA58D1049B0BD799EB3878CF6E944E14683BA367B3B1AF22D40383229827BB35747BA98278527E29F00B754D8C35CB1B63
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c4cab608b8a04eab8c1e7080fb9b732d.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:777306lZ8Sw

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.3575242409879404
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MVyAGBcGhGEivjNTZD:qgFq6g1af+Mk9coGEiRTZD
MD5:	CBB2948CD20CF034ED031EF64CF03813
SHA1:	A517491571C8B546F8A18D9D7F51D1A43037C9AF
SHA-256:	56F6AD7DC97B9378019BEA9752C837CAF1D7A84D54FC34E3C458CB5F449F70E3
SHA-512:	7522BC90183714982C80C07DAF2E6D37F5369A1C4B1D7E2178EC159F009A8E242DD252D3685ADF4BF7F8F639473B22AEDFB92CD87A6FC81E6BE479FE4A1906B3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c62bb9fecd9c4b80b92adb2acfe9cabb.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77759pDqkww

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.413075113883029
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/3THt61Jy+sjswxJm:SbFuFyLVIg1BG+f+MRYKjLTTIWTIL
MD5:	C2ECEF847ED2B7CC9DE4996A6EB1BDEF
SHA1:	D61BB38289C7716E633CCB0D23BC4C9A5D135AA9
SHA-256:	82CDDE2127BE317D580870AF689066A86C2342672CFF39A40C952DA0B9357125
SHA-512:	23779C5FEA3C29752B6B5534A1DC49F6D3786B85087DFA4E74427C18853D06B06245D81DC8938B7736CB53440F1299B0BB6FF46D185FFB3357D99D8FA42CB8FA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=59c6baae4e60458198af1c7ad8e4154b.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77809V4ywPu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.415991432468786
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoXJEda5XHv8jNq:qgFqo6g7/+0+f+MoZEE5Xv+q
MD5:	B6E0E368BBDEEC8D14737EDFEC728530
SHA1:	7CFF8C37B5F220E3F2E9BD14B664FB6F180C8F9C
SHA-256:	C9DCA9A2F315DCF97E25CBFEA3A4B372596A1B7C8AC5BE4A1F4850E45E1411F5
SHA-512:	37793DB6021CE6C032B269E0E55C2286FA8E375D6D5906B02E19E6AD91D9AC327743CCCC1E59FF4A7997EBF277D42F3C0F0C9FC434CD5E5D5A21CF2FAF257267
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b9fa2576361b4d2a8ab738e9b2ed4e0b.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77811tYfFkv

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.422458739796171
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmyKBqTpjXE7Fg2jk:SbFuFyLVI6g7/+BG+f+MyKBEjyTjNq
MD5:	2CC07B50071E65F9FC4CC6361ED3AC93
SHA1:	5F62CC4AA13193E5A47735BDA343B6F6EDBF9B4E
SHA-256:	6AF3AB8A6EAED6F4B2F7476195548FBD78C2AE0A7F32B700E7F18ED3691D091D
SHA-512:	252B7D87AB737A1BF38092412DBE116D06F70517421E2F552221939499EE5C582A5CD89E36D255202720F2BC58529EE4BC4DCA28446AB7177CB0EA55819348BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=82fc07dee3c84970b752632371a0f0ed.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78875CkC2Yu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.536972999520145
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M580O/F2jFQMzKaBu:qgFqo6g7/+0+f+M+TuTmh
MD5:	12CE42980538AC18078B70B1DCD5D037
SHA1:	CB2A5BDA30BC4D49F55B0B21F1DE7B97A943B355
SHA-256:	F2695C0F6486AD16AE62A3315186A8B3099581DF050B7C75301CF168677EA9F1
SHA-512:	C673A6F716E320FAA2F43F9C56CB3E7BDFA48A4C0732A076B6135235A0D4A1C92FE337F76EE33F2CD6BCC98FC834D27EEF1879CC3F720536589CF9A9A20477EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a996ecc0eb2412b80cf970dfb45e282.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78877nq97Zu

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.507141273298762
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6VcCC28jFQMzKaBu:qgFqdg7/+0+f+MRZTmh
MD5:	9B370E51D48A82F163C68C25C7D824B0
SHA1:	0D711426354B59ECCACAE08FC44F7CA087D353FF
SHA-256:	C0C6B8297EF0079B5A6694384A97A07CAEEFB014C0CF15C4BFA8B82D2D506897
SHA-512:	115BA66F3104D19E900A9A096AE91F51F71996D1ECAD171A17BFF674DA3BCDFFCF922FE94E0C5492BD6A0B28E94C64E6B4ECCC852F93DFD0B6C695314FE29363
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0ccc23653578471ca97cdc4e4160de5d.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79565fUvoAP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.508121507573036
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GxS5WhXVbpvF2jsv:SbFuFyLVIg1BG+f+M4+8Whlbpv8ji4s
MD5:	6D1582057BBCD3B2B50385B5AFF89666
SHA1:	FD0769A32F8F4C3585173DBD56FE2850FC0D6696
SHA-256:	DCB8CCD56BBEEB0D5C1FC28F1717A6A22C7D8F7BE2653FFF546E7B6ABEAC7EE9
SHA-512:	CAB55E573271410883C66F92C338DCB11BBE16F5DD460850E772DE1B83BFA7D09A2E2C0F226689AE0B397D02C4F59A4A49C0709588B6646766ECF649F90CB5C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2ce0a30a49f54e8381c224c67907e7e9.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79566q3LF0N

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.419765261797153
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyBcIrFkTbDjX/Ovsj:SbFuFyLVIg1BG+f+MyTcjW022josQu
MD5:	A5684B87242A72674B81AA836D04EA3B
SHA1:	9B768CA9FEB60110F3585B49C779AD4A1FC5C826
SHA-256:	65A0812E7EC39EC3FA4F8456DA5D1DFAF9ADDE014264371FC5E9390D27C416CB
SHA-512:	5804C58889569D393A81AC697022156A696546879126B2E7C7A9AF55F7CF3AA6B0C51E904F1121C627CE20B83E416A59A2354599D981D5AE4C5626C7AF7FA8C4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83c97431910d4ceba639f349b21ed7d8.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79574SejQKO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.37071080887886
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxms97dE2TCe6shuqjst:SbFuFyLVIg1BG+f+MsBxTERqjdCLKzK
MD5:	09AF5FC6079523185875FB65B3D944FD
SHA1:	7A082872D2570AC266DA4AA09C24785C6BBFD500
SHA-256:	ACF9FF9EF942C41728CCBF50D0C1D868B944861F51278DE2375111B57609719E
SHA-512:	EC80B7CB1BD895B22BD3954E81A1AEEF96B91E729C54EB43E9EB6B85828342AA5ABFA36C0DBA4AB0F84FCB8D17F2CC6C225AC120872E59B6A41D3A07874907EB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f061649a9a18448c982d909d96f8ed25.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79583HY1inL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.481230365503748
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzVtN4UdNAuqjsicWg:SbFuFyLVIg1BG+f+MxLRATjZcHcljX+
MD5:	76CC60E337D220B292263018DDBACB0D
SHA1:	B119FFA25A3892E2A3BCAB23708AECF63C916643
SHA-256:	E505A827D259097FBB9310A8F74B3DADF93A043DAD0A2A1DF73BACADA9C0DFA0
SHA-512:	750FD6B3B01CD40EDCD3EBF0C55AF1C10932171DABAB08FDA3542C83D78B2E1A68DF62E091CA17319DDDE9F76ABA12337C00F6143672CACFCADA0FAC19191319
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=940bdba2f9894b549f3f032bdfa518b8.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:795920X9WAP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.555525852832889
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4E1+KZvXXsjs7LbgS:SbFuFyLVIg1BG+f+M4dkX8ji4s
MD5:	F41184CF247AFD698B24B9DA4D941BA2
SHA1:	B0E03DF471374BFA3531E28C57E6FCDF357A961E
SHA-256:	CC07D0F5B9EE6031639707525B7E7FCA44CBD52EA22832E6F5BD8068E80204F9
SHA-512:	9A79D01F5A920B5C3621C62701B9B8658EDFFB7B50D81B39A25491625F969AEF5631E382E58040FC0A0F14C5CAFCBE2F3C71D0E23AF17C5C347262A1AFB763E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2a8f74ebb1b943cc92c860ab85179363.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:796677sGnfP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4524213509661985
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+98CTSScBHjvXsjs2Ax:SbFuFyLVIg1BAf+M+mRSyT8jNALyAZD
MD5:	C8EA95FB4A1F7BDE6EB7F858DCCB89E3
SHA1:	441C3D73464AC4E10E4398ADE38260B9FA67BC5F
SHA-256:	EEF297C14AE2F3E530CF28AA615A99E69658054456CC0CE4BC4A8DDDBB230470
SHA-512:	F59AA3F1D6AC0BC2A26F0E02B80839FFF7375127C9081B98D563043F3FA15E9E00EC565D2DD201A23873189E265FEB455EA34FE709908AAFB6B98EB19C970F6A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=44b2861af36d4cb6819198bc5f09dbd0.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79748CtOUsM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394843260843542
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyTQKWWVCsTvF2jswK:SbFuFyLVIg1BG+f+MycNSCsTv8jLkGq
MD5:	8E405753559A240A1EF5A59CEC043145
SHA1:	A4D08F33ED7366E0B8B9494F9FE71505C38AF23C
SHA-256:	AAC28662B7C612F2D8D0F14A9F20E5693C226CE0C506C370AF4808A6D4C1C412
SHA-512:	B46EE0BDC7E1DF6C64BB1F664DD327F30D2D286403CE78FAB004DF31B0DCBA8A8EC86E18B3A86B60EAB103AEF30C0CEBC55C461404DB7A8E9180BB39DAE50A78
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8999951b03ea467ea244074445c5c656.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79837JbYpHO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.433224780712886
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrJyAic6SVtVy3uxsjsd:SbFuFyLVIg1BAf+MQAiujqjNdQIeXD
MD5:	E5FB6C3D74DE41AEC067BFEC8F22A0F5
SHA1:	64788FC9C0F5A988F5C5A0E2E76CBE877030B73F
SHA-256:	F9BFC2FA14684FB928E4AFBEEAACCA39D9A3D7D17F27EB6592A67ACEAC64E6EF
SHA-512:	7E760D850CA3C2B2C95E60735B89E65BE38B93416879D008F8509DADD0E1CC59EF10D1C6301EF05BF4F3BD2322F7CFE5A4DD2ED143A2D9EF3D6D7CA6434BFA60
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=af0bdb1730584a9689709e9a00da3783.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80892XtqIUC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.470496576965129
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7HTAIxhmwXbbZjs77:SbFuFyLVIg1BG+f+MHAJyfZji4s
MD5:	2483CFFD673EAF4B8EED05D140C8F687
SHA1:	F5EFF04A967A80221784ADA8021C8BA18C41F308
SHA-256:	A76BDDC5860982C0E03F52D115C3D9A5AA7B73AA99C45DB5F4651C53D81027D2
SHA-512:	F8E676BDC50132723CBBB291CED57A19FA6415E4F15BA282B01E90AC196A5C7ABC5C757E32F41C3A128BC877E777AA1D84BFB33D749A959ACC5EB36B3A2042CB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=12231eabc8ab44bf8edb5bddad281bed.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81925TbNGhF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.437203138485253
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmugH7RjecSDoUj2jsc:SbFuFyLVIg1BG+f+Mugb5woU6josQu
MD5:	590DED2A2D7C98CE7655376141AFE197
SHA1:	B6EB1DC23555168C19048FEC231C2F030F49164B
SHA-256:	F21F56825A56A5F8EDB08123BF2227A261E496739D4D592DFF425BA19EB8522A
SHA-512:	5A6D53263DE2F8373E2389793C4D99D7ADB16DB30A64C6F5E777983100E3D22556FF1AA0A07903C41296F151AEDFC6581B82E86A23D720867872721C729FC9BE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=df21b044569846bc8e3e75a0147fad14.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81926VcFRaF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.42011744078531
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzK/B2GxsjsicWmI2d:SbFuFyLVIg1BG+f+MejqjZcHcljX+
MD5:	707FF21CCF2C530BC5C5284D6DF22C94
SHA1:	F77CAC997383A6E4CB0BECCC188AA6B15B791426
SHA-256:	8A9FCB486EFF622517487E894AC58584199C164763162DB90715132B0F903DC0
SHA-512:	979595A121E682DBB16D3851E506E0955A62AE1053F515800234E2EA8E3271CEC046DC2D16820A799BE31A8DC3F1C175EC32A02494A28056D0FDB8D192E1BEB2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=95d2e5dc0d564c6099a019d24e2d34c3.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:819419DmgUF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3900525761207065
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzb4G1hDL7WjsmNz0/:SbFuFyLVIg1BG+f+MX4G/bWjdCLKzK
MD5:	6CAE9E06BAB397244085DDB898E6F6C5
SHA1:	97A9DB8C62D76FF68BBBAB9459221CA519CB5C95
SHA-256:	81D9D63D8491C3D92C572F7F65D3C3850F762F0F7923FA49077532A92EA74565
SHA-512:	3BB0ED781CD1E01DADF9F29CC3D8EC4C44A0C99AFF54CDDD39FDE921EC604D5FC0E5353290B0CF9F2BD978E940C51E4A528ABDE2095929AB4A4D734DE6922FDF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9db59ef950044b5a977c1857820d4dc7.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81942SrzTJD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.392180507079599
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyBf0W0SRocpL0Q0Zjsa:SbFuFyLVIg1BAf+MyV0g+c0jNTZD
MD5:	1BB6A17979980A693F39BC34E21979A2
SHA1:	A848CBA6AA90C10192D1949F9A2AC1AD859647E3
SHA-256:	92A8E2F2E38238C59D449000CB0D4FD33626C08515291B55231E5632ED83275C
SHA-512:	012FA1764300D6B05CBE713848C454D7EBA3DFBD81238DCFB36DAEC263F5EB29F0159D3A34F573315AC5F532E9E766DA3DABB72C40462CB012512BAD887B6121
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83cba3e437b74bf19fd3e2a47d057e45.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81951qWVy4D

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4445907103801
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm60J3QT34FUv8jswxM:SbFuFyLVIg1BG+f+M6y3GujLTTIWTIL
MD5:	E9D4420D98D381567CF05D0EFBC09A18
SHA1:	7F9806F9F227877B7280B6B4B418437EE2864F7B
SHA-256:	44C2556E1513130901A398A93173F1E1342934E40D822611699EADA62330339B
SHA-512:	DECF2A81B13CBBF7202D7B84F37E973EA0EDCCF202E5E797486B1F8594C46931E32451A6081AA3472B101BEBD55632855DDB6AB2B8D404333EC797D0D5CF3745
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00960e410e18481994eb56b3547d20cf.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81952Tg4OpE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.511985467431335
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrayEwGDVQXSFGRzhy:SbFuFyLVIg1BG+f+M+yEwMEpRzhTji4s
MD5:	38FB5FFB439F9B1E5CA7FB6B5CCD0813
SHA1:	1ED25DC704DBDE793216D9FBA6CA6F11EAFA6646
SHA-256:	A4D7867795B1BBDFB6CE052B079BDA937E3FC1BDF50FD01F05D8CC69D573A5A4
SHA-512:	6D192AAFC3EDE40DE14DDB4FA44E5F9D9A18348ADF24162F575196B98126D656A115C74F09DEF00E8E12C55E2AF594436B56031A534202EBFFDD90B4C9390437
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=abafdb7799d74a649cf052c457ea6c49.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:82030UQu9pE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3380105367135595
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrfdswEnKGSwxsjshP:SbFuFyLVIg1BG+f+MpsxKLwqjbVC
MD5:	DE40C87E96AE0D14C47A43A2B3FE2EBE
SHA1:	1AFAE4E46612CBD872CB512D23E7B041728FCA65
SHA-256:	F68F78904EEBC2E969A141A354B36FCD2FA569B5C7A599E8887ED7F3E1713897
SHA-512:	A3F3D0EDDD42879F0A2752069DED656B3D30B8371E3159D535CD1B5D5576A440433C3D093BF1B363F5032E2EE918CF194FF5C4B0AB8E3C5BB81AE649F88E07A8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac8a8b10e0ad4353accf930ca05a52ba.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:82122WSqhKC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.380326193494244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpnWRbDVgTQV3V78j+:SbFuFyLVIg1BG+f+MzyV78jLkGq
MD5:	FC1BC6467F35696ECFDCFE59E47AEF36
SHA1:	DD246C5709B782A18388AE579ADE993048CAB40A
SHA-256:	DF439C59794A2DD212B79E1391F8E5BF628EF8FB7BF5C18262F6950A4CEFD739
SHA-512:	B98C6D1F3A02F660C22F1FAA80A6408A4B24FDA0FC2461522C1111F007074F8199C7A4435928762E0CB3ED3C7A568FA83F169C0DB0819E05C72F821CF8D9DD58
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c1e1938e7eff4cf0be6320d5e0e99a17.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:82146uByWZD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.392727841862214
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/z+LFYSDvVA1sjk:SbFuFyLVK6g7/+BG+f+MiRYSDNAmjNq
MD5:	CE175934A3E6FEE3B49B7607E8665FE4
SHA1:	0933629C1E631A151E3F60D6B75E02433D7BB027
SHA-256:	A439F823846F87C101C474326B95C93A9DA67A7D22BE55F106FC307253E643EB
SHA-512:	90DE11C3B4B18AEDFED7E65941C306D45A9B401BB6DE8FCA42F4C5E963353DA47D7A13ABE11C73E5FAF503B79F90A1322528A4B9E86C83FB2379392E5EEA3CEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=54ce9a01529d4f10a56390c37c1790e0.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82148au4xVC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.394203483363724
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuqGGAAzXRcAHB44:SbFuFyLVI6g7/+BG+f+MuqR9NB2w0jNq
MD5:	A7B582E5F5C266B322DEA4A219886064
SHA1:	100FCDF5E5035F0BA9C58B41A556BBBFE65FFF1E
SHA-256:	1BE5ECAE98380BFFB936C60938E64A75D94AD10DDAB96B13535F691407EB90EE
SHA-512:	41D685FC873A0C17E1B5171D6D32CA9637A420C09ED40A78B4DC59F45712DC56F339E2E28F0686914E9111BCD3938ED92FEF05E274FB100F338FC35C1B11B50A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd58ccee5a0249e1aff40d79f94be026.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82283WsuQsF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.420449848512496
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrxWB+lb7EWk+sjsis:SbFuFyLVIg1BG+f+MLbgWkTjZcHBrt
MD5:	4FF312866CF6EC47587BA22549982B84
SHA1:	9E3F9D338AB890FB734C3C0EEA11D5FFFE0A9BEB
SHA-256:	34E2EFBB8DDFA022C353F59C1A19D267C67A7787E7B88EDC21A339F42C121208
SHA-512:	818A3D136D7E27B1AA7D93FAC9596B83285CA0E10BE528C36EAA370697423975EB9CC3B9715A12743B2CD42A2B6674BE4C52D6FEE49785C173AD4D6DD48797F2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=adb3d1fd14574cd382af2cb324b738f0.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:82284dlOI7C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.489772816877602
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4nfXVyKs22jFQMzKaBu:qgFqo6g7/+0+f+M4fQTmh
MD5:	DB8F8E6C669E48901FA125B289EDE176
SHA1:	0498A0B753363E8B5BA611F0571987D68833EFE5
SHA-256:	6DF1EF157191EA56823E6E64A02BF1C60DA4E6DD2355C397BF71ED041C3C905B
SHA-512:	BF24D814568F916CF8AC1ED985CBD1E062A2FC2257D5CF40967D29E3D67D8D362D2F66F33A628BE4F319231173BE71E07A3EE6D09C179118C000032C32D425B4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=25ade057829442a2a1ca85e6d0460af8.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:822908rbuaE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.531718699292715
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MMpwUjFQMzKaBu:qgFqdg7/+0+f+MGXTmh
MD5:	BBCD70022C579CE06F63DF73F96C5C2A
SHA1:	41B3C16087064A52BF48C8258362AA9AAC64FC4C
SHA-256:	1AA54016B4E624158DCE6C1220E34AB2C49D488D4252C5814BA5C2B7178F7DAF
SHA-512:	D49B1C1587348779A1E5DB8384FB7F9F8A552449917CAB1EAEEC3F5D8B119D27941EB14AED9BFE4FEB2F42A9C66AFED7995B6AA514E9B6954588C4ADD0B7A062
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=78a0e597498e4225ac3d626fe3d61c6e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:82439xT49DD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.342142784313369
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzbdJ6U3DjRD0wsjs4:SbFuFyLVIg1BG+f+M1nvR4joa
MD5:	D318811A7FC61BE57B13DE65639569B0
SHA1:	D392B8C9C6F8EE57E4949DAB64306A738B6B8D39
SHA-256:	3D31598C30457E41744CE265E504438C0710334B9228E8B5CA53966BF6D2F888
SHA-512:	8B977BA175BDAA2E8D1E45C0C07D52605C2D3825AA0352D13AB0978838BE770D3CE20CBE3CECD68BA1AB28CAA60A3BCC6074C91F07363B9A0EE4E2A28D589CE3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9fb80bf8ee054cf08f5105a0bf263ff3.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:824789zwLWE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.323641923618211
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmywEqGHRvzbhpv3+sh:SbFuFyLVIg1BG+f+MywEqGdbh93TjtWQ
MD5:	BF35672333002DE1EFBA8FCE3D72B226
SHA1:	1474B96CCC77AE3E36E1D6AE18F8761DBC7A9135
SHA-256:	9BA0C3EC518064227CF1E36A2603AFF15DBDEEBD6A82B4F1A2EE3BCABED434EB
SHA-512:	4A339E662C605EB397FCA2B1C3C5CA00C3E6F3AC7E13D63574E1A9D59B8760ED88261C3A3B598812D2E977E4848025E9964FB1DDA71AF516EDDBF3271E245467
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=843af190ec3e47b39879074b78dcac8a.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:82603L307uC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.450157638880689
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrN12QbbXBdVH+vsMn:SbFuFyLVIg1BG+f+M513PrVe5qjNE
MD5:	7636DC401A967BD98723EC3FB504BC90
SHA1:	284A2219527A1B3D2959F1CE15E1801AFB1976B2
SHA-256:	11E255DF582B26F9DF7099B13C31F79C390E118901EBFCDCFCB7C8F11E04FDFD
SHA-512:	FAA408775BC51AC0549800C0F8E4A1948CC1624A9A8F1A4A0417ECBF5CC43D63956AF524EA6E6CE15CF534DF7884031461B69891A7948E485C8929965DFB0C4B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a2b8a90956224c8fa800823c85eb77f1.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:82682auwj1F

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.3582889097817805
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpa1UREtGr0shuxsjK:SbFuFyLVIg1BG+f+MxitC0AuqjZcHjv
MD5:	D7E4A48009629CEB7822BF92B5DA80B7
SHA1:	A6CFA2EB24FD2B8076A976E02488D6DEFC843CC9
SHA-256:	396910DA60339BBA3665846AF789AAC34E845A68663683497E4B9B551A483A6F
SHA-512:	73BA170F10017C172918029E90A6FD90E892ED5F4277F63FD11E3A1C7BC42B043D4E8DCFBEAC4C832376E107AD9C55B792D9A6724B73EB1875AEAA047DCB749B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb0279b1d70447dd8e4ae78c809a556c.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:82738rxtWFF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.355025617926139
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoHjOEd0xSNTVdhhuQ:SbFuFyLVIg1BG+f+MoHjj0xSTVd+qjtT
MD5:	70F8DA0C393809BC0ABA9A4A8BECB5D3
SHA1:	4FF655D165D2E22A917F67FDB5778BCB554E26F0
SHA-256:	0F6610B1AC22E90B7840099F05C54591FA9ABACF9A791CBAF83FF0D4DC9B28E1
SHA-512:	DBF43CF41F2C9C67E658854D2969F5B4D24925AB6169529B6971E51AE91C7B406AF713EFD6762F9657E73758D15740765BE50C74CE3D9D2D6E4249881DDE00A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bb7e4d4182164d23bdb39b47dfb3108c.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:82849hKgnPG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3411707287090495
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5u3XrA/euF4uxsjs4:SbFuFyLVIg1BG+f+MYU/ejTjoa
MD5:	F196286DBFDF4C7A6B23B3E589CBFBD8
SHA1:	9951BC253B6BB20601175340901DD593AA89A73B
SHA-256:	C2DD6378492067EFB21852E573FB635E6091BAC86BBCEA80997E1F0AE56C5EEC
SHA-512:	918B0446A431FB9E21EF6D48A2C27B02B583A415FAD8958CC35535FC9EBCD070440C78EEAF909D72EC2112BF3D9A07DDD768272606534201DF0999B550ABDE03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3777b7a2194e47549764ab518ab09beb.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat030EBCp

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0WBXDJn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0ckBQqd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0ikYV1c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0rDQgmA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1275qxbUp

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.488843777285795
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff68CgH2BJojt6B:qgFq30dABibBAgH2PojIB
MD5:	78C191D4A0C1109DCAB5084BE076F803
SHA1:	27690B368C6151A72F3E65EF3CA2A71437D725B8
SHA-256:	8624498A36BDA4CD13A21FE4CF4216C42A52EA9D959D38084F12CEA8B7EBE451
SHA-512:	F698855E223AECB52F0022C0AE2D5AD8F01553B70DCCDBF1F18DF98FA0EF2D16C018B13C887FB8C85F9D786FB8A8FA38F9702BB0D8B9CB36D8226B4DBBE057EB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12349.REALTIME=1732844295216886.MONOTONIC=501374441.LAST_SESSION_TIMESTAMP=501479920.

/run/systemd/users/.#1276HhK89

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.487876318222014
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffsTgHvoXLt6qb:qgFq30dABibB0TgHOLIqb
MD5:	5A1ACD3FFED07F7D797852F7244DF95A
SHA1:	D8BD9D93B5FFD5D9EA71ABF33538AA2166326D0F
SHA-256:	C01C6AB75759D656AB57342FEB48F45E6A7BAA52317CAAF430419ACAB1015FE8
SHA-512:	EC1FA04FDAC2D6CF6EAA9AEEB32C572A89DB2251CF3AAF7F90C2FDDFC078A83FE333C2DAB0E4D5A361A82D1F2F9AD7951DD5EE8EE1C9A855B82FA1BDE58CFB78
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13340.REALTIME=1732844373028528.MONOTONIC=579186083.LAST_SESSION_TIMESTAMP=579288395.

/run/systemd/users/.#127CYeWJ9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127PGNptd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.305338963493623
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffzgHvoXfQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBbgHOrthQHtPYq9M
MD5:	9CBB9E7DC445F9C6D4E3FBD74EAC0628
SHA1:	6641D72433A3A72CE9975D2773BAC78DBD36F6C2
SHA-256:	C1A924D6B321B1B53833E1838A4ED2EF81F54283E81DF6C72FEECD7504043F5C
SHA-512:	0C30559E1DE706D4C1C67001956E287421D96F841B47C3557EBD59B94D0E6E49E24C21300C7FD06894739691D1D0DD356590B956EBDB7C58BD302964F83538EA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13158.REALTIME=1732844373028528.MONOTONIC=579186083.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YJdzld

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.305338963493623
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffzgHvoXfQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBbgHOrthQHtPYq9M
MD5:	9CBB9E7DC445F9C6D4E3FBD74EAC0628
SHA1:	6641D72433A3A72CE9975D2773BAC78DBD36F6C2
SHA-256:	C1A924D6B321B1B53833E1838A4ED2EF81F54283E81DF6C72FEECD7504043F5C
SHA-512:	0C30559E1DE706D4C1C67001956E287421D96F841B47C3557EBD59B94D0E6E49E24C21300C7FD06894739691D1D0DD356590B956EBDB7C58BD302964F83538EA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13158.REALTIME=1732844373028528.MONOTONIC=579186083.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127dxwAdp

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127fDpVuq

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.340347198704037
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgH2Q2Jo/x43veH206qodr1Vn:SbFuFyL3BVgdL87iesnAiRJgH2BJojtA
MD5:	6BAD3263995097F254BD259BCE1D267C
SHA1:	F1FF6BE675E13975C1D498089E062D88528084C0
SHA-256:	1F9A1422BB5D48D33E2A4B79F50F5E2880CB6DEAD354B319D94D8892AAA900A4
SHA-512:	0B54466A4BF07DBC55B37C57590266573AD07A2507BB1581EE0CACA5317F7002843A419217A5734F4DC213A36C504B030CD3468FB33AFBA1AC6DC12B2601831A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1732844295216886.MONOTONIC=501374441.LAST_SESSION_TIMESTAMP=501479920.

/run/systemd/users/.#127lYiigd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.487876318222014
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffsTgHvoXLt6qb:qgFq30dABibB0TgHOLIqb
MD5:	5A1ACD3FFED07F7D797852F7244DF95A
SHA1:	D8BD9D93B5FFD5D9EA71ABF33538AA2166326D0F
SHA-256:	C01C6AB75759D656AB57342FEB48F45E6A7BAA52317CAAF430419ACAB1015FE8
SHA-512:	EC1FA04FDAC2D6CF6EAA9AEEB32C572A89DB2251CF3AAF7F90C2FDDFC078A83FE333C2DAB0E4D5A361A82D1F2F9AD7951DD5EE8EE1C9A855B82FA1BDE58CFB78
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13340.REALTIME=1732844373028528.MONOTONIC=579186083.LAST_SESSION_TIMESTAMP=579288395.

/run/systemd/users/.#127r45ndq

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.303461924440501
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgH2BJogKQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgH2PogEthQHtP0
MD5:	ED043B3FCE535C878D9C8672AE264CDD
SHA1:	B513E2EE41AC5260AE541D0C6AADDE0330C3F4D7
SHA-256:	C155B720208E5504729FEE99A75879317EF7A6E9AE71962377B84AAAB22F034E
SHA-512:	CACE50BDD46496C1BC907B79297E59A4033B335D1888FE60E14BBEA1A778DE4757C1710D74E48FCCC65E3F870D8702FFE7BAE02D2DE335A7E415C40F5162B99F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1732844295216886.MONOTONIC=501374441.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127rGxBVm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.303461924440501
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6NEJgH2BJogKQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEEJgH2PogEthQHtP0
MD5:	ED043B3FCE535C878D9C8672AE264CDD
SHA1:	B513E2EE41AC5260AE541D0C6AADDE0330C3F4D7
SHA-256:	C155B720208E5504729FEE99A75879317EF7A6E9AE71962377B84AAAB22F034E
SHA-512:	CACE50BDD46496C1BC907B79297E59A4033B335D1888FE60E14BBEA1A778DE4757C1710D74E48FCCC65E3F870D8702FFE7BAE02D2DE335A7E415C40F5162B99F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12287.REALTIME=1732844295216886.MONOTONIC=501374441.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127uxhBnc

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.326890644736817
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgH2CXto/Wwc63H206qodsmddWn:SbFuFyL3BVgdL87iesnAiRJgHvoXLt6e
MD5:	CAC4AFEF1444C5AFE278C6E8907CD073
SHA1:	90B8A66F8BD29E45D92AB5F1466AB8D5281ACB47
SHA-256:	9CFEEFD2AE6C7F6C6DFB1E84C0856DE0ABCF4D3A7A49342696267E8C17664852
SHA-512:	6C5204EE901535C658EBC3E9C714758D79F7B97A822657201E6A2540105C513119DC3C435E4367325E1FC7FD529F1A3425FE128295221ED4BC72A65168EAE024
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1732844373028528.MONOTONIC=579186083.LAST_SESSION_TIMESTAMP=579288395.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:MXv:M/
MD5:	D6C57E4B63C655D85E70B32B7397816A
SHA1:	2E79A530D73B963E08BD3899B751A5C957989D6E
SHA-256:	A67453509F45DC7624387920F3D2C026C7823534EDB7EFD78DC5242F259A1BCD
SHA-512:	D20215C458814EF475A5F603348130DBF1444649B0DCCD0E5B1AA65008C8543A0B06D0EF11A6BAD5C8B5C3860A729A492B5738AA9121E882F2AC43A6D4C6209F
Malicious:	false
Preview:	6762.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:NFn:Pn
MD5:	8142F298A2EB05DBAF5B832BBCB20491
SHA1:	29AA162F960111FE58727BADB6315BC9228ADB32
SHA-256:	04E388DFF73D864C0B06BD75FC165EE65ED21C310D9EE1E8EDC9E897F4F60B00
SHA-512:	777D3411178507345066A10D9E7A2F6EBB968E1E8AB4558D1D21B2F0297946A1DA38338602C8463F225993393E395810BF131840399F362E334CFACE11B8C657
Malicious:	false
Preview:	6770.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018082
Encrypted:	false
SSDEEP:	3:FG1sXlXEWtl/XC4tl:Fh+ylP
MD5:	7573A106FCBAA6C67BDA0DF0D10F881F
SHA1:	903B69A5237A727E171BE9E08EA8412B2E9B36B4
SHA-256:	682BA203D47EE973C7C43A8BC9180C3E69B05D2A33F2EE68C811750B394A8571
SHA-512:	9868A0D81DAE7B349EE914A8AB103E379F3C5A5B01C1D09CDAABF3513B2C59AD09009B04957C864B809A157E5BAB41EFF197B2772DE18DC1814D455B30F7B9EF
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................R.Ig........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:NJn:zn
MD5:	3A94CF2448488648A02A2F3A9C73784D
SHA1:	17F76A65F90434C1EE2C9F3CB33E305B653345C6
SHA-256:	FDD00031C7A720554ABB4956158029B2F3FAA72C3ADF431FCE303F6568697D2C
SHA-512:	5C594BE7E908BC45B4E7F7010EA2EC1489C3D7263154E90C4985FE4C2684554120ABC2C54A4C07E89E7240615351E3229F170E105D913D1835812D8D7C12995D
Malicious:	false
Preview:	6774.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.3709505944546687
Encrypted:	false
SSDEEP:	3:MTv:Mj
MD5:	D587288A0B3EEDA4D63D48FEFBF57ECF
SHA1:	016373E40D52FCF26F96D250EE881723E95EA8A4
SHA-256:	DE83819D49BED62A1ADCEB4BE5CE18B09284C932050A90292E4099962783D83C
SHA-512:	4175A20960ABBC5FDF765C84568AD9449514A483407AF0AC9471F8AE096B471E47FD383B336C67B20B51E750BA09FC30FCBE85D3C745471D1A1CCC545BD17482
Malicious:	false
Preview:	6766.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:OWmJ:OWmJ
MD5:	372C9A9A5BF69F00FB667477026893FB
SHA1:	0991107508E99E3896146F58F11CD14E4BE1D1C5
SHA-256:	6B34D4E32E2462EED055306CE42D0CC231BBD899D5BA9B8210B5851FB27D9BA2
SHA-512:	37BA57263A8E4409E2D2BFE5FDD8CE97D2558EB90F50CC36B684E8DF1ADC28AC8CED6A61AB0B62E8E094BEC612A205995A9E253DD98E64C17078D0CC09772CB7
Malicious:	false
Preview:	6743.6744.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:NFn:Pn
MD5:	8142F298A2EB05DBAF5B832BBCB20491
SHA1:	29AA162F960111FE58727BADB6315BC9228ADB32
SHA-256:	04E388DFF73D864C0B06BD75FC165EE65ED21C310D9EE1E8EDC9E897F4F60B00
SHA-512:	777D3411178507345066A10D9E7A2F6EBB968E1E8AB4558D1D21B2F0297946A1DA38338602C8463F225993393E395810BF131840399F362E334CFACE11B8C657
Malicious:	false
Preview:	6770.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:NJn:zn
MD5:	3A94CF2448488648A02A2F3A9C73784D
SHA1:	17F76A65F90434C1EE2C9F3CB33E305B653345C6
SHA-256:	FDD00031C7A720554ABB4956158029B2F3FAA72C3ADF431FCE303F6568697D2C
SHA-512:	5C594BE7E908BC45B4E7F7010EA2EC1489C3D7263154E90C4985FE4C2684554120ABC2C54A4C07E89E7240615351E3229F170E105D913D1835812D8D7C12995D
Malicious:	false
Preview:	6774.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.3709505944546687
Encrypted:	false
SSDEEP:	3:MTv:Mj
MD5:	D587288A0B3EEDA4D63D48FEFBF57ECF
SHA1:	016373E40D52FCF26F96D250EE881723E95EA8A4
SHA-256:	DE83819D49BED62A1ADCEB4BE5CE18B09284C932050A90292E4099962783D83C
SHA-512:	4175A20960ABBC5FDF765C84568AD9449514A483407AF0AC9471F8AE096B471E47FD383B336C67B20B51E750BA09FC30FCBE85D3C745471D1A1CCC545BD17482
Malicious:	false
Preview:	6766.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:OWmJ:OWmJ
MD5:	372C9A9A5BF69F00FB667477026893FB
SHA1:	0991107508E99E3896146F58F11CD14E4BE1D1C5
SHA-256:	6B34D4E32E2462EED055306CE42D0CC231BBD899D5BA9B8210B5851FB27D9BA2
SHA-512:	37BA57263A8E4409E2D2BFE5FDD8CE97D2558EB90F50CC36B684E8DF1ADC28AC8CED6A61AB0B62E8E094BEC612A205995A9E253DD98E64C17078D0CC09772CB7
Malicious:	false
Preview:	6743.6744.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:NFn:Pn
MD5:	8142F298A2EB05DBAF5B832BBCB20491
SHA1:	29AA162F960111FE58727BADB6315BC9228ADB32
SHA-256:	04E388DFF73D864C0B06BD75FC165EE65ED21C310D9EE1E8EDC9E897F4F60B00
SHA-512:	777D3411178507345066A10D9E7A2F6EBB968E1E8AB4558D1D21B2F0297946A1DA38338602C8463F225993393E395810BF131840399F362E334CFACE11B8C657
Malicious:	false
Preview:	6770.

/tmp/qemu-open.h2nkrH (deleted)

Download File

Process:	/tmp/dvwkja7.elf
File Type:	data
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.2824842613426
Encrypted:	false
SSDEEP:	3:TglSOXc8HJN:TgIeJN
MD5:	C5011CDA2B63741923AE9DB5386185D6
SHA1:	693E9B1A5A97C0462916130B749B9A135744A10A
SHA-256:	FEF9E748C4A51EC4883381A7719D67AC06597FFCEF5A0CF9632F8AD1BF2EA925
SHA-512:	A9CED9357802E934CA8A1D8D52FF6E7CA4B1F4729E4B111B8BE0E1F8D95D2D8619C0C8D80CAAFD4F7B26CAEB379BE4EFC30F052D6DD77954CC923437C1EEF6F3
Malicious:	false
Preview:	/tmp/dvwkja7.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.JEPWX2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.OWGRX2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1531
Entropy (8bit):	4.938098387332695
Encrypted:	false
SSDEEP:	24:qZeEagS/LLeNAv6eNA2+VAz0pYrcLJrE48wrCQU:heSv6eSfVAyYrOrE4jrCn
MD5:	B4151780A9CD6C19DFAF197FE432BD76
SHA1:	B67AAB15A7691F500FA095FEF3CBF036AD69F88B
SHA-256:	58332F5AF9B88D6D89646F6248A185B586D37C8013278F6B7EC9FE427036A615
SHA-512:	93554C073E1F31360EBBCE81A8C600BD71370AEBEB098D0E8CF6FD1729886C03ECCF2867DA85792976E31F30CF6270A915AAB3211C5497F3E4651DED85E794CF
Malicious:	false
Preview:	Nov 28 19:39:29 galassia systemd-logind[6652]: Failed to add user by file name 1000, ignoring: Invalid argument.Nov 28 19:39:30 galassia systemd-logind[6652]: User enumeration failed: Invalid argument.Nov 28 19:39:30 galassia systemd-logind[6652]: User of session c2 not known..Nov 28 19:39:30 galassia systemd-logind[6652]: User of session 2 not known..Nov 28 19:39:30 galassia systemd-logind[6652]: Session enumeration failed: No such file or directory.Nov 28 19:39:30 galassia systemd-logind[6652]: Watching system buttons on /dev/input/event0 (Power Button).Nov 28 19:39:30 galassia systemd-logind[6652]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Nov 28 19:39:30 galassia systemd-logind[6652]: New seat seat0..Nov 28 19:39:32 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Nov 28 19:39:33 galassia systemd-logind[6652]: Failed to start session scope session-c1.scope: Unit session-c1.scope alre

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4111525174736723
Encrypted:	false
SSDEEP:	3:F31HlK3uP/XS3uPd:F3HP
MD5:	5DE30397AB9DEC444C157517D3531829
SHA1:	2EB55F91E4910C3ECA17953B5E7B1036D06E3D5F
SHA-256:	4E8474E7DA9E0CB771F9EC6AD88EAE4177DFD3B2E5BCC03B148F83CE251B911E
SHA-512:	74EC9BDD96B3D92FA39E059D9E1D0BA250883D2F593BA6AC52F9012D20D24365C9CA9E7A3D802FBDA2A9E178CB87FFF2992FCCF35128C1253B742D462A3EFE0E
Malicious:	false
Preview:	LPKSHHRH.................ut2w7H7.NK...Y..................................ut2w7H7.NK...Y.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.427819184140339
Encrypted:	false
SSDEEP:	3:F31HlhuOP6TktTuOP6TkP/l:F3RuOCTkBuOCTkP
MD5:	86BDFD23D11CB8C6C04788A035D01A9C
SHA1:	66AE116E61CD7F92D0B4888867D07CE5493953F8
SHA-256:	5F30B44E9EEA2C6B38DC0E3E82916ACA6E16FA6B883AC35C9F49024055FB81BD
SHA-512:	56B9E5B75B7796683D0335BE478825BDE9FEE026BA8E58C3B3147B499D934981651EC72EAAB5B9BA4D526A551330414C87E8926A6AE0817EA3C70FCBA6F45440
Malicious:	false
Preview:	LPKSHHRH..................P..F._.n..H...................................P..F._.n..H.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	CSV text
Category:	dropped
Size (bytes):	9673
Entropy (8bit):	5.0388715287796995
Encrypted:	false
SSDEEP:	96:R8RRXuAu//jNo2V6WOr8MueYf6D5UDYdLHzflqUx1fQRJ:m9uJpUr8yEU5UEdL4Ux1fQRJ
MD5:	B41DB272A971B0A6FD484714373A32F6
SHA1:	065034D7BFDE8A43A62C7354416D430D80068A05
SHA-256:	5E2CE6AF1B1B178FA9E36A9989F1B8A83F7D0813E5C4E7BCD230AE61FDBE14B7
SHA-512:	DD362DCA02DFF66FD4C0C6342FD5C6094E164B2843883355E255CCB018EA4F1446AF16827FCD07E7EE23E04A7B35385881FE10965450149E13358AC249FB2EE4
Malicious:	false
Preview:	Nov 28 19:39:26 galassia kernel: [ 571.964687] New task spawned: old: (tgid 6709, tid 6709), new (tgid: 6709, tid: 6712).Nov 28 19:39:26 galassia kernel: [ 571.965592] New task spawned: old: (tgid 6709, tid 6709), new (tgid: 6709, tid: 6713).Nov 28 19:39:26 galassia kernel: [ 571.977312] New task spawned: old: (tgid 6709, tid 6713), new (tgid: 6709, tid: 6714).Nov 28 19:39:26 galassia kernel: [ 572.159202] New task spawned: old: (tgid 6710, tid 6710), new (tgid: 6710, tid: 6715).Nov 28 19:39:26 galassia kernel: [ 572.577803] New task spawned: old: (tgid 6710, tid 6710), new (tgid: 6710, tid: 6716).Nov 28 19:39:28 galassia kernel: [ 572.732462] New task spawned: old: (tgid 6710, tid 6710), new (tgid: 6710, tid: 6717).Nov 28 19:39:28 galassia kernel: [ 574.041196] New task spawned: old: (tgid 6718, tid 6718), new (tgid: 6718, tid: 6719).Nov 28 19:39:28 galassia kernel: [ 574.064388] New task spawned: old: (tgid 6718, tid 6718), new (tgid: 6718, tid: 6720).Nov 28 19:39:28 galassia

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	28689
Entropy (8bit):	5.158587206970401
Encrypted:	false
SSDEEP:	768:5mzoNxjGI40IGPqyLBu2nGNvvTd4fo/fE6d8FhDFe64US+QPJlra1h/4O6EQC+ML:5YSu2nGQfo/fE6d+
MD5:	E71466FD57D32F382CBA07D896C746A8
SHA1:	7DC465056C501BD7E8C5472EEEF48D2990F97D54
SHA-256:	FE7C81FA6FE65AF75196BC26DFDAFD28A4A1943CE44A9F528DD140D5787539A3
SHA-512:	0AE005ACB6C356BFC9E61B55A72D3CA63A2617562939FE51F1E03FC65038ED5F7F3C149D0556DE468C119DE9A930E207C16818AC257945DD4A4EF8FA5991E3DC
Malicious:	false
Preview:	Nov 28 19:39:26 galassia kernel: [ 571.396626] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Nov 28 19:39:26 galassia kernel: [ 571.396688] systemd[1]: rsyslog.service: Failed with result 'signal'..Nov 28 19:39:26 galassia kernel: [ 571.410148] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Nov 28 19:39:26 galassia kernel: [ 571.410152] systemd[1]: dbus.service: Failed with result 'signal'..Nov 28 19:39:26 galassia kernel: [ 571.410855] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Nov 28 19:39:26 galassia kernel: [ 571.410932] systemd[1]: whoopsie.service: Failed with result 'signal'..Nov 28 19:39:26 galassia kernel: [ 571.411285] systemd[1]: getty@tty2.service: Succeeded..Nov 28 19:39:26 galassia kernel: [ 571.411952] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 2..Nov 28 19:39:26 galassia kernel: [ 571.412590] systemd[1]: Started D-Bus System Message Bus

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018082
Encrypted:	false
SSDEEP:	3:FG1sXlXEWtl/XC4tl:Fh+ylP
MD5:	7573A106FCBAA6C67BDA0DF0D10F881F
SHA1:	903B69A5237A727E171BE9E08EA8412B2E9B36B4
SHA-256:	682BA203D47EE973C7C43A8BC9180C3E69B05D2A33F2EE68C811750B394A8571
SHA-512:	9868A0D81DAE7B349EE914A8AB103E379F3C5A5B01C1D09CDAABF3513B2C59AD09009B04957C864B809A157E5BAB41EFF197B2772DE18DC1814D455B30F7B9EF
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................R.Ig........................................

Source: dvwkja7.elf	ReversingLabs: Detection: 44%
Source: dvwkja7.elf	Virustotal: Detection: 37%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:52696 -> 178.215.238.4:33966
Source: global traffic	TCP traffic: 192.168.2.23:50042 -> 89.190.156.145:7733

File type:	ELF 32-bit LSB executable, ARM, EABI4 version 1 (SYSV), statically linked, with debug_info, not stripped
Entropy (8bit):	5.978817344761834
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	dvwkja7.elf
File size:	217'047 bytes
MD5:	b68bdebddddfd9506637eef57ada50c5
SHA1:	cf57bc838388792ffa6eed0d171e7cf59f1b9f0d
SHA256:	b2b7259f28f175afda3273c05113c1855ac1dc9478cdcb3730fd4aa8bb3ddce1
SHA512:	fdd0e27ae969565ab279353ea6f3f616cc8bdef0ac3b0b3d41e547b7891e118536cc30c20f4b811c8fb99d68024957a1c4cc07666e3aac565aad38d047cdbfd5
SSDEEP:	6144:bhpTxexSpqERVR9kmat421IrX5u+FPENCYTdUM/RWhY:bnxcwRV3kmaS21Irpf9ETdp/AO
TLSH:	49241946AA418F13C4D627BAF6DF42453333A75493EB73069924AFB43B8779E4F22601
File Content Preview:	.ELF..............(.........4...d.......4. ...(........p............x...x................................................................U..........................................Q.td..................................-...L..................@-.,@...0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8194
Flags:	0x4000002
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	5
Section Header Offset:	171108
Section Header Size:	40
Number of Section Headers:	30
Header String Table Index:	27

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80d4	0xd4	0x10	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x80f0	0xf0	0x1de68	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x25f58	0x1df58	0x10	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x25f68	0x1df68	0x2a14	0x0	0x2	A	0	0	8
.ARM.extab	PROGBITS	0x2897c	0x2097c	0x18	0x0	0x2	A	0	0	4
.ARM.exidx	ARM_EXIDX	0x28994	0x20994	0x178	0x0	0x82	AL	2	0	4
.eh_frame	PROGBITS	0x31000	0x21000	0x4	0x0	0x3	WA	0	0	4
.tdata	PROGBITS	0x31004	0x21004	0x4	0x0	0x403	WAT	0	0	4
.tbss	NOBITS	0x31008	0x21008	0x8	0x0	0x403	WAT	0	0	4
.init_array	INIT_ARRAY	0x31008	0x21008	0x4	0x0	0x3	WA	0	0	4
.fini_array	FINI_ARRAY	0x3100c	0x2100c	0x4	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x31010	0x21010	0x4	0x0	0x3	WA	0	0	4
.got	PROGBITS	0x31014	0x21014	0xc0	0x4	0x3	WA	0	0	4
.data	PROGBITS	0x310d4	0x210d4	0x2f0	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x313c4	0x213c4	0x5234	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x213c4	0x108a	0x0	0x0		0	0	1
.debug_aranges	PROGBITS	0x0	0x22450	0x180	0x0	0x0		0	0	8
.debug_pubnames	PROGBITS	0x0	0x225d0	0x23e	0x0	0x0		0	0	1
.debug_info	PROGBITS	0x0	0x2280e	0x2aa7	0x0	0x0		0	0	1
.debug_abbrev	PROGBITS	0x0	0x252b5	0x99a	0x0	0x0		0	0	1
.debug_line	PROGBITS	0x0	0x25c4f	0x118c	0x0	0x0		0	0	1
.debug_frame	PROGBITS	0x0	0x26ddc	0x33c	0x0	0x0		0	0	4
.debug_str	PROGBITS	0x0	0x27118	0xabc	0x1	0x30	MS	0	0	1
.debug_loc	PROGBITS	0x0	0x27bd4	0x182a	0x0	0x0		0	0	1
.debug_ranges	PROGBITS	0x0	0x293fe	0x730	0x0	0x0		0	0	1
.ARM.attributes	ARM_ATTRIBUTES	0x0	0x29b2e	0x16	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x29b44	0x11e	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x2a114	0x7160	0x10	0x0		29	1064	4
.strtab	STRTAB	0x0	0x31274	0x3d63	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
EXIDX	0x20994	0x28994	0x28994	0x178	0x178	4.6653	0x4	R	0x4	.ARM.exidx
LOAD	0x0	0x8000	0x8000	0x20b0c	0x20b0c	6.1155	0x5	R E	0x8000	.init .text .fini .rodata .ARM.extab .ARM.exidx
LOAD	0x21000	0x31000	0x31000	0x3c4	0x55f8	4.7205	0x6	RW	0x8000	.eh_frame .tdata .tbss .init_array .fini_array .jcr .got .data .bss
TLS	0x21004	0x31004	0x31004	0x4	0xc	2.0000	0x4	R	0x4	.tdata .tbss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Nov 29, 2024 02:38:01.022968054 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Nov 29, 2024 02:39:21.043076038 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 02:37:11.545104980 CET	192.168.2.23	8.8.8.8	0x18f0	Standard query (0)	raw.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Nov 29, 2024 02:37:11.680866957 CET	192.168.2.23	8.8.8.8	0xd865	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	455	false
Nov 29, 2024 02:37:11.806407928 CET	192.168.2.23	8.8.8.8	0xd865	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	455	false
Nov 29, 2024 02:37:11.932245016 CET	192.168.2.23	8.8.8.8	0xd865	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Nov 29, 2024 02:37:12.057296991 CET	192.168.2.23	8.8.8.8	0xd865	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Nov 29, 2024 02:37:12.182212114 CET	192.168.2.23	8.8.8.8	0xd865	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Nov 29, 2024 02:37:14.487534046 CET	192.168.2.23	8.8.8.8	0xa07a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Nov 29, 2024 02:37:14.611598015 CET	192.168.2.23	8.8.8.8	0xa07a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Nov 29, 2024 02:37:14.735299110 CET	192.168.2.23	8.8.8.8	0xa07a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Nov 29, 2024 02:37:14.860255957 CET	192.168.2.23	8.8.8.8	0xa07a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Nov 29, 2024 02:37:14.984256029 CET	192.168.2.23	8.8.8.8	0xa07a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	458	false
Nov 29, 2024 02:37:17.201459885 CET	192.168.2.23	8.8.8.8	0x1a19	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Nov 29, 2024 02:37:17.325643063 CET	192.168.2.23	8.8.8.8	0x1a19	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Nov 29, 2024 02:37:17.449264050 CET	192.168.2.23	8.8.8.8	0x1a19	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Nov 29, 2024 02:37:17.572771072 CET	192.168.2.23	8.8.8.8	0x1a19	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Nov 29, 2024 02:37:17.696209908 CET	192.168.2.23	8.8.8.8	0x1a19	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Nov 29, 2024 02:37:19.877969027 CET	192.168.2.23	8.8.8.8	0xc9e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	463	false
Nov 29, 2024 02:37:20.002039909 CET	192.168.2.23	8.8.8.8	0xc9e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	464	false
Nov 29, 2024 02:37:20.125741959 CET	192.168.2.23	8.8.8.8	0xc9e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	464	false
Nov 29, 2024 02:37:20.249274015 CET	192.168.2.23	8.8.8.8	0xc9e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	464	false
Nov 29, 2024 02:37:20.372581005 CET	192.168.2.23	8.8.8.8	0xc9e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	464	false
Nov 29, 2024 02:37:22.544883013 CET	192.168.2.23	8.8.8.8	0x6b07	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Nov 29, 2024 02:37:22.668562889 CET	192.168.2.23	8.8.8.8	0x6b07	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Nov 29, 2024 02:37:22.792471886 CET	192.168.2.23	8.8.8.8	0x6b07	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Nov 29, 2024 02:37:22.916445017 CET	192.168.2.23	8.8.8.8	0x6b07	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	466	false
Nov 29, 2024 02:37:23.040533066 CET	192.168.2.23	8.8.8.8	0x6b07	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	467	false
Nov 29, 2024 02:37:25.217200041 CET	192.168.2.23	8.8.8.8	0xa346	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Nov 29, 2024 02:37:25.341324091 CET	192.168.2.23	8.8.8.8	0xa346	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Nov 29, 2024 02:37:25.465627909 CET	192.168.2.23	8.8.8.8	0xa346	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Nov 29, 2024 02:37:25.590126038 CET	192.168.2.23	8.8.8.8	0xa346	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Nov 29, 2024 02:37:25.714176893 CET	192.168.2.23	8.8.8.8	0xa346	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	469	false
Nov 29, 2024 02:37:27.842627048 CET	192.168.2.23	8.8.8.8	0x25bb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	471	false
Nov 29, 2024 02:37:27.966377020 CET	192.168.2.23	8.8.8.8	0x25bb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Nov 29, 2024 02:37:28.192682028 CET	192.168.2.23	8.8.8.8	0x25bb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Nov 29, 2024 02:37:28.316741943 CET	192.168.2.23	8.8.8.8	0x25bb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Nov 29, 2024 02:37:28.440726042 CET	192.168.2.23	8.8.8.8	0x25bb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	472	false
Nov 29, 2024 02:37:30.618172884 CET	192.168.2.23	8.8.8.8	0x3e06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Nov 29, 2024 02:37:30.742332935 CET	192.168.2.23	8.8.8.8	0x3e06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Nov 29, 2024 02:37:30.867274046 CET	192.168.2.23	8.8.8.8	0x3e06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false
Nov 29, 2024 02:37:30.992557049 CET	192.168.2.23	8.8.8.8	0x3e06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	475	false
Nov 29, 2024 02:37:31.116252899 CET	192.168.2.23	8.8.8.8	0x3e06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	475	false
Nov 29, 2024 02:37:33.340257883 CET	192.168.2.23	8.8.8.8	0x242a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Nov 29, 2024 02:37:33.464184046 CET	192.168.2.23	8.8.8.8	0x242a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Nov 29, 2024 02:37:33.588097095 CET	192.168.2.23	8.8.8.8	0x242a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Nov 29, 2024 02:37:33.712519884 CET	192.168.2.23	8.8.8.8	0x242a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Nov 29, 2024 02:37:33.836755037 CET	192.168.2.23	8.8.8.8	0x242a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	477	false
Nov 29, 2024 02:37:36.013689041 CET	192.168.2.23	8.8.8.8	0x5fc4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Nov 29, 2024 02:37:36.137375116 CET	192.168.2.23	8.8.8.8	0x5fc4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Nov 29, 2024 02:37:36.261615038 CET	192.168.2.23	8.8.8.8	0x5fc4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Nov 29, 2024 02:37:36.384999037 CET	192.168.2.23	8.8.8.8	0x5fc4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Nov 29, 2024 02:37:36.508492947 CET	192.168.2.23	8.8.8.8	0x5fc4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	480	false
Nov 29, 2024 02:37:38.731093884 CET	192.168.2.23	8.8.8.8	0xa26a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	482	false
Nov 29, 2024 02:37:38.854875088 CET	192.168.2.23	8.8.8.8	0xa26a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	482	false
Nov 29, 2024 02:37:38.978604078 CET	192.168.2.23	8.8.8.8	0xa26a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	482	false
Nov 29, 2024 02:37:39.102442980 CET	192.168.2.23	8.8.8.8	0xa26a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Nov 29, 2024 02:37:39.226421118 CET	192.168.2.23	8.8.8.8	0xa26a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	483	false
Nov 29, 2024 02:37:41.356620073 CET	192.168.2.23	8.8.8.8	0x7bdc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	485	false
Nov 29, 2024 02:37:41.480886936 CET	192.168.2.23	8.8.8.8	0x7bdc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	485	false
Nov 29, 2024 02:37:41.604892969 CET	192.168.2.23	8.8.8.8	0x7bdc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	485	false
Nov 29, 2024 02:37:41.729140043 CET	192.168.2.23	8.8.8.8	0x7bdc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	485	false
Nov 29, 2024 02:37:41.853179932 CET	192.168.2.23	8.8.8.8	0x7bdc	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	485	false
Nov 29, 2024 02:37:43.984350920 CET	192.168.2.23	8.8.8.8	0x6df6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Nov 29, 2024 02:37:44.108889103 CET	192.168.2.23	8.8.8.8	0x6df6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Nov 29, 2024 02:37:44.232799053 CET	192.168.2.23	8.8.8.8	0x6df6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Nov 29, 2024 02:37:44.357336998 CET	192.168.2.23	8.8.8.8	0x6df6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Nov 29, 2024 02:37:44.481558084 CET	192.168.2.23	8.8.8.8	0x6df6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	488	false
Nov 29, 2024 02:37:46.734920979 CET	192.168.2.23	8.8.8.8	0xdadf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	490	false
Nov 29, 2024 02:37:46.859915018 CET	192.168.2.23	8.8.8.8	0xdadf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	490	false
Nov 29, 2024 02:37:46.984035969 CET	192.168.2.23	8.8.8.8	0xdadf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Nov 29, 2024 02:37:47.108244896 CET	192.168.2.23	8.8.8.8	0xdadf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Nov 29, 2024 02:37:47.232815981 CET	192.168.2.23	8.8.8.8	0xdadf	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	491	false
Nov 29, 2024 02:37:49.458112001 CET	192.168.2.23	8.8.8.8	0x14f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	493	false
Nov 29, 2024 02:37:49.582072020 CET	192.168.2.23	8.8.8.8	0x14f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	493	false
Nov 29, 2024 02:37:49.706269026 CET	192.168.2.23	8.8.8.8	0x14f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	493	false
Nov 29, 2024 02:37:49.829982996 CET	192.168.2.23	8.8.8.8	0x14f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	493	false
Nov 29, 2024 02:37:49.954008102 CET	192.168.2.23	8.8.8.8	0x14f7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	493	false
Nov 29, 2024 02:37:52.134351015 CET	192.168.2.23	8.8.8.8	0x6416	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Nov 29, 2024 02:37:52.258697987 CET	192.168.2.23	8.8.8.8	0x6416	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Nov 29, 2024 02:37:52.382886887 CET	192.168.2.23	8.8.8.8	0x6416	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Nov 29, 2024 02:37:52.507133961 CET	192.168.2.23	8.8.8.8	0x6416	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Nov 29, 2024 02:37:52.631269932 CET	192.168.2.23	8.8.8.8	0x6416	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	496	false
Nov 29, 2024 02:37:54.757172108 CET	192.168.2.23	8.8.8.8	0x9046	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	498	false
Nov 29, 2024 02:37:54.880589008 CET	192.168.2.23	8.8.8.8	0x9046	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	498	false
Nov 29, 2024 02:37:55.003972054 CET	192.168.2.23	8.8.8.8	0x9046	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Nov 29, 2024 02:37:55.127501965 CET	192.168.2.23	8.8.8.8	0x9046	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Nov 29, 2024 02:37:55.251234055 CET	192.168.2.23	8.8.8.8	0x9046	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	499	false
Nov 29, 2024 02:37:57.570569992 CET	192.168.2.23	8.8.8.8	0x9789	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	501	false
Nov 29, 2024 02:37:57.697606087 CET	192.168.2.23	8.8.8.8	0x9789	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	501	false
Nov 29, 2024 02:37:57.850769043 CET	192.168.2.23	8.8.8.8	0x9789	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	501	false
Nov 29, 2024 02:37:57.977639914 CET	192.168.2.23	8.8.8.8	0x9789	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	501	false
Nov 29, 2024 02:37:58.105287075 CET	192.168.2.23	8.8.8.8	0x9789	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	502	false
Nov 29, 2024 02:37:58.543440104 CET	192.168.2.23	1.1.1.1	0x3f10	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 02:37:58.543473959 CET	192.168.2.23	1.1.1.1	0x3326	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Nov 29, 2024 02:37:59.201250076 CET	192.168.2.23	1.1.1.1	0x2f5e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Nov 29, 2024 02:38:00.257421017 CET	192.168.2.23	8.8.8.8	0xca59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	504	false
Nov 29, 2024 02:38:00.383929014 CET	192.168.2.23	8.8.8.8	0xca59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	504	false
Nov 29, 2024 02:38:00.510888100 CET	192.168.2.23	8.8.8.8	0xca59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	504	false
Nov 29, 2024 02:38:00.638138056 CET	192.168.2.23	8.8.8.8	0xca59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	504	false
Nov 29, 2024 02:38:00.763385057 CET	192.168.2.23	8.8.8.8	0xca59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	504	false
Nov 29, 2024 02:38:02.952282906 CET	192.168.2.23	8.8.8.8	0xbde1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	506	false
Nov 29, 2024 02:38:03.076951981 CET	192.168.2.23	8.8.8.8	0xbde1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Nov 29, 2024 02:38:03.201400042 CET	192.168.2.23	8.8.8.8	0xbde1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Nov 29, 2024 02:38:03.326014996 CET	192.168.2.23	8.8.8.8	0xbde1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Nov 29, 2024 02:38:03.450759888 CET	192.168.2.23	8.8.8.8	0xbde1	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	507	false
Nov 29, 2024 02:38:05.636992931 CET	192.168.2.23	8.8.8.8	0x9a75	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	509	false
Nov 29, 2024 02:38:05.760469913 CET	192.168.2.23	8.8.8.8	0x9a75	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	509	false
Nov 29, 2024 02:38:05.884426117 CET	192.168.2.23	8.8.8.8	0x9a75	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	509	false
Nov 29, 2024 02:38:06.008394003 CET	192.168.2.23	8.8.8.8	0x9a75	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	510	false
Nov 29, 2024 02:38:06.133085966 CET	192.168.2.23	8.8.8.8	0x9a75	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	510	false
Nov 29, 2024 02:38:08.355027914 CET	192.168.2.23	8.8.8.8	0x9f0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	256	false
Nov 29, 2024 02:38:08.478416920 CET	192.168.2.23	8.8.8.8	0x9f0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	256	false
Nov 29, 2024 02:38:08.601749897 CET	192.168.2.23	8.8.8.8	0x9f0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	256	false
Nov 29, 2024 02:38:08.724962950 CET	192.168.2.23	8.8.8.8	0x9f0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	256	false
Nov 29, 2024 02:38:08.848318100 CET	192.168.2.23	8.8.8.8	0x9f0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	256	false
Nov 29, 2024 02:39:12.653812885 CET	192.168.2.23	1.1.1.1	0x4277	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Nov 29, 2024 02:39:12.653853893 CET	192.168.2.23	1.1.1.1	0x51d1	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Nov 29, 2024 02:39:27.775222063 CET	192.168.2.23	1.1.1.1	0x11d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Nov 29, 2024 02:40:08.517292976 CET	192.168.2.23	8.8.8.8	0x60e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	376	false
Nov 29, 2024 02:40:08.640672922 CET	192.168.2.23	8.8.8.8	0x60e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	376	false
Nov 29, 2024 02:40:08.765252113 CET	192.168.2.23	8.8.8.8	0x60e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	376	false
Nov 29, 2024 02:40:08.889467001 CET	192.168.2.23	8.8.8.8	0x60e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	377	false
Nov 29, 2024 02:40:09.013000965 CET	192.168.2.23	8.8.8.8	0x60e7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	377	false
Nov 29, 2024 02:40:11.186398983 CET	192.168.2.23	8.8.8.8	0x6019	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Nov 29, 2024 02:40:11.310431004 CET	192.168.2.23	8.8.8.8	0x6019	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Nov 29, 2024 02:40:11.434336901 CET	192.168.2.23	8.8.8.8	0x6019	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Nov 29, 2024 02:40:11.557826042 CET	192.168.2.23	8.8.8.8	0x6019	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Nov 29, 2024 02:40:11.681080103 CET	192.168.2.23	8.8.8.8	0x6019	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Nov 29, 2024 02:40:13.855252028 CET	192.168.2.23	8.8.8.8	0x838d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	381	false
Nov 29, 2024 02:40:13.978688002 CET	192.168.2.23	8.8.8.8	0x838d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Nov 29, 2024 02:40:14.102891922 CET	192.168.2.23	8.8.8.8	0x838d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Nov 29, 2024 02:40:14.226428032 CET	192.168.2.23	8.8.8.8	0x838d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Nov 29, 2024 02:40:14.350699902 CET	192.168.2.23	8.8.8.8	0x838d	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Nov 29, 2024 02:40:16.479861975 CET	192.168.2.23	8.8.8.8	0xc7b7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	384	false
Nov 29, 2024 02:40:16.603328943 CET	192.168.2.23	8.8.8.8	0xc7b7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	384	false
Nov 29, 2024 02:40:16.727041960 CET	192.168.2.23	8.8.8.8	0xc7b7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	384	false
Nov 29, 2024 02:40:16.850970030 CET	192.168.2.23	8.8.8.8	0xc7b7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	384	false
Nov 29, 2024 02:40:16.974437952 CET	192.168.2.23	8.8.8.8	0xc7b7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	385	false
Nov 29, 2024 02:40:19.148751974 CET	192.168.2.23	8.8.8.8	0x54eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	387	false
Nov 29, 2024 02:40:19.272579908 CET	192.168.2.23	8.8.8.8	0x54eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	387	false
Nov 29, 2024 02:40:19.397461891 CET	192.168.2.23	8.8.8.8	0x54eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	387	false
Nov 29, 2024 02:40:19.521334887 CET	192.168.2.23	8.8.8.8	0x54eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	387	false
Nov 29, 2024 02:40:19.645361900 CET	192.168.2.23	8.8.8.8	0x54eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	387	false
Nov 29, 2024 02:40:21.821413994 CET	192.168.2.23	8.8.8.8	0x479c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	389	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 02:37:11.679331064 CET	8.8.8.8	192.168.2.23	0x18f0	No error (0)	raw.cardiacpure.ru	178.215.238.4	A (IP address)	IN (0x0001)	false
Nov 29, 2024 02:37:58.763920069 CET	1.1.1.1	192.168.2.23	0x3f10	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Nov 29, 2024 02:37:58.763920069 CET	1.1.1.1	192.168.2.23	0x3f10	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Nov 29, 2024 02:39:12.874982119 CET	1.1.1.1	192.168.2.23	0x4277	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Nov 29, 2024 02:39:12.874982119 CET	1.1.1.1	192.168.2.23	0x4277	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-11-29 01:38:03 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-11-29 01:38:04 UTC	25	IN	HTTP/1.1 100 Continue
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-11-29 01:38:04 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-11-29 01:38:05 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Fri, 29 Nov 2024 01:38:05 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	01:37:10
Start date (UTC):	29/11/2024
Path:	/tmp/dvwkja7.elf
Arguments:	/tmp/dvwkja7.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	01:37:11
Start date (UTC):	29/11/2024
Path:	/tmp/dvwkja7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	01:38:18
Start date (UTC):	29/11/2024
Path:	/tmp/dvwkja7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	01:39:14
Start date (UTC):	29/11/2024
Path:	/tmp/dvwkja7.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	01:37:50
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:37:52
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:37:55
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:37:56
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:37:57
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:37:58
Start date (UTC):	29/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report dvwkja7.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6510/oom_score_adj

/proc/6755/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:75329VF5RLx

/run/systemd/journal/streams/.#9:75494I5JhSu

/run/systemd/journal/streams/.#9:76471fbJOsu

/run/systemd/journal/streams/.#9:76472HcWyjx

/run/systemd/journal/streams/.#9:76498XJZJDu

/run/systemd/journal/streams/.#9:76605Z5TUXy

/run/systemd/journal/streams/.#9:76675E3YuSx

/run/systemd/journal/streams/.#9:76769MUsnZx

/run/systemd/journal/streams/.#9:767920RReNv

/run/systemd/journal/streams/.#9:76842jHk1dw

/run/systemd/journal/streams/.#9:76849WPa7Eu

/run/systemd/journal/streams/.#9:76854xgmxyw

/run/systemd/journal/streams/.#9:76859FG326x

/run/systemd/journal/streams/.#9:76864EDByox

/run/systemd/journal/streams/.#9:777306lZ8Sw

/run/systemd/journal/streams/.#9:77759pDqkww

Linux Analysis Report
dvwkja7.elf

Start time (UTC):	01:37:59
Start date (UTC):	29/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	01:38:00
Start date (UTC):	29/11/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	01:38:03
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:38:01
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:38:02
Start date (UTC):	29/11/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	01:38:05
Start date (UTC):	29/11/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	01:38:12
Start date (UTC):	29/11/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	01:38:13
Start date (UTC):	29/11/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	01:38:14
Start date (UTC):	29/11/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	01:38:15
Start date (UTC):	29/11/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a