Edit tour

Linux Analysis Report
iwir64.elf

Overview

General Information

Sample name:	iwir64.elf
Analysis ID:	1566262
MD5:	7bbdc5c843c2d6a1dd44c4f8292ae3bd
SHA1:	e05dcf35d38fe69e8916cca7b010629e113f2d43
SHA256:	a00117a5ad41cfacac850edcdb707e66926e858a4368ce137d38ac7fdd5b932e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1566262
Start date and time:	2024-12-01 21:28:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	iwir64.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/160@74/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: iwir64.elf

Runtime Messages

Command:	/tmp/iwir64.elf
PID:	6235
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

iwir64.elf (PID: 6235, Parent: 6156, MD5: 7bbdc5c843c2d6a1dd44c4f8292ae3bd) Arguments: /tmp/iwir64.elf

iwir64.elf New Fork (PID: 6236, Parent: 6235)

iwir64.elf New Fork (PID: 6237, Parent: 6236)

iwir64.elf New Fork (PID: 6398, Parent: 6237)

sh (PID: 6398, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6399, Parent: 6398)

ps (PID: 6399, Parent: 6398, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

iwir64.elf New Fork (PID: 6902, Parent: 6237)

sh (PID: 6902, Parent: 6237, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6904, Parent: 6902)

ps (PID: 6904, Parent: 6902, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6238, Parent: 1477)

sh (PID: 6238, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6238, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6243, Parent: 1)

systemd-hostnamed (PID: 6243, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6388, Parent: 1320)

Default (PID: 6388, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6395, Parent: 1320)

Default (PID: 6395, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6457, Parent: 1)

journalctl (PID: 6457, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6470, Parent: 1)

systemd-journald (PID: 6470, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6475, Parent: 1)

journalctl (PID: 6475, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6491, Parent: 1)

dbus-daemon (PID: 6491, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6497, Parent: 1860)

pulseaudio (PID: 6497, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6499, Parent: 1)

rsyslogd (PID: 6499, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6503, Parent: 1)

systemd-logind (PID: 6503, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6562, Parent: 1)

rtkit-daemon (PID: 6562, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6569, Parent: 1)

polkitd (PID: 6569, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6573, Parent: 1)

agetty (PID: 6573, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6575, Parent: 1320)

Default (PID: 6575, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6576, Parent: 1)

gpu-manager (PID: 6576, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6577, Parent: 6576)

sh (PID: 6577, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6578, Parent: 6577)

grep (PID: 6578, Parent: 6577, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6579, Parent: 6576)

sh (PID: 6579, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6580, Parent: 6579)

grep (PID: 6580, Parent: 6579, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6582, Parent: 6576)

sh (PID: 6582, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6583, Parent: 6582)

grep (PID: 6583, Parent: 6582, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6586, Parent: 6576)

sh (PID: 6586, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6587, Parent: 6586)

grep (PID: 6587, Parent: 6586, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6588, Parent: 6576)

sh (PID: 6588, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6591, Parent: 6576)

sh (PID: 6591, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6592, Parent: 6591)

grep (PID: 6592, Parent: 6591, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6597, Parent: 6576)

sh (PID: 6597, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6598, Parent: 6597)

grep (PID: 6598, Parent: 6597, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6599, Parent: 6576)

sh (PID: 6599, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6600, Parent: 6599)

grep (PID: 6600, Parent: 6599, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gvfsd-fuse New Fork (PID: 6593, Parent: 2038)

fusermount (PID: 6593, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6601, Parent: 1)

generate-config (PID: 6601, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6602, Parent: 6601)

pkill (PID: 6602, Parent: 6601, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6603, Parent: 1)

gdm-wait-for-drm (PID: 6603, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6609, Parent: 1)

gdm3 (PID: 6609, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6612, Parent: 6609)

plymouth (PID: 6612, Parent: 6609, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6622, Parent: 6609)

gdm-session-worker (PID: 6622, Parent: 6609, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6628, Parent: 6622)

gdm-wayland-session (PID: 6628, Parent: 6622, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6630, Parent: 6628)

dbus-daemon (PID: 6630, Parent: 6628, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6632, Parent: 6630)

dbus-daemon New Fork (PID: 6633, Parent: 6632)

false (PID: 6633, Parent: 6632, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6634, Parent: 6628)

dbus-run-session (PID: 6634, Parent: 6628, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6635, Parent: 6634)

dbus-daemon (PID: 6635, Parent: 6634, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6636, Parent: 6609)

Default (PID: 6636, Parent: 6609, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6637, Parent: 6609)

Default (PID: 6637, Parent: 6609, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6613, Parent: 1)

accounts-daemon (PID: 6613, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6617, Parent: 6613)

language-validate (PID: 6617, Parent: 6613, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6618, Parent: 6617)

language-options (PID: 6618, Parent: 6617, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6619, Parent: 6618)

sh (PID: 6619, Parent: 6618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6620, Parent: 6619)

locale (PID: 6620, Parent: 6619, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6621, Parent: 6619)

grep (PID: 6621, Parent: 6619, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6639, Parent: 1)

agetty (PID: 6639, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6640, Parent: 1)

rsyslogd (PID: 6640, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6642, Parent: 1)

dbus-daemon (PID: 6642, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6648, Parent: 1)

gpu-manager (PID: 6648, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6649, Parent: 6648)

sh (PID: 6649, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6650, Parent: 6649)

grep (PID: 6650, Parent: 6649, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6651, Parent: 6648)

sh (PID: 6651, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6653, Parent: 6651)

grep (PID: 6653, Parent: 6651, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6713, Parent: 6648)

sh (PID: 6713, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6715, Parent: 6713)

grep (PID: 6715, Parent: 6713, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6716, Parent: 6648)

sh (PID: 6716, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6717, Parent: 6716)

grep (PID: 6717, Parent: 6716, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6718, Parent: 6648)

sh (PID: 6718, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6719, Parent: 6718)

grep (PID: 6719, Parent: 6718, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6720, Parent: 6648)

sh (PID: 6720, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6721, Parent: 6720)

grep (PID: 6721, Parent: 6720, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6722, Parent: 6648)

sh (PID: 6722, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6723, Parent: 6722)

grep (PID: 6723, Parent: 6722, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6726, Parent: 6648)

sh (PID: 6726, Parent: 6648, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6727, Parent: 6726)

grep (PID: 6727, Parent: 6726, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6656, Parent: 1)

systemd-logind (PID: 6656, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6728, Parent: 1)

generate-config (PID: 6728, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6729, Parent: 6728)

pkill (PID: 6729, Parent: 6728, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6730, Parent: 1)

gdm-wait-for-drm (PID: 6730, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6734, Parent: 1)

rsyslogd (PID: 6734, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6735, Parent: 1)

dbus-daemon (PID: 6735, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6741, Parent: 1)

rsyslogd (PID: 6741, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6742, Parent: 1)

dbus-daemon (PID: 6742, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6750, Parent: 1)

systemd-logind (PID: 6750, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6809, Parent: 1)

journalctl (PID: 6809, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6810, Parent: 1)

systemd-journald (PID: 6810, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6813, Parent: 1)

rsyslogd (PID: 6813, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6814, Parent: 1)

dbus-daemon (PID: 6814, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6817, Parent: 1)

systemd-logind (PID: 6817, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6875, Parent: 1)

systemd-journald (PID: 6875, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6879, Parent: 1)

agetty (PID: 6879, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6880, Parent: 1)

gpu-manager (PID: 6880, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6882, Parent: 6880)

sh (PID: 6882, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6883, Parent: 6882)

grep (PID: 6883, Parent: 6882, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6885, Parent: 6880)

sh (PID: 6885, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6886, Parent: 6885)

grep (PID: 6886, Parent: 6885, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6887, Parent: 6880)

sh (PID: 6887, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6891, Parent: 6887)

grep (PID: 6891, Parent: 6887, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6894, Parent: 6880)

sh (PID: 6894, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6895, Parent: 6894)

grep (PID: 6895, Parent: 6894, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6897, Parent: 6880)

sh (PID: 6897, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6898, Parent: 6897)

grep (PID: 6898, Parent: 6897, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6899, Parent: 6880)

sh (PID: 6899, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6901, Parent: 6899)

grep (PID: 6901, Parent: 6899, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6903, Parent: 6880)

sh (PID: 6903, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6905, Parent: 6903)

grep (PID: 6905, Parent: 6903, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6908, Parent: 6880)

sh (PID: 6908, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6909, Parent: 6908)

grep (PID: 6909, Parent: 6908, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6884, Parent: 1)

rsyslogd (PID: 6884, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6910, Parent: 1)

generate-config (PID: 6910, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6911, Parent: 6910)

pkill (PID: 6911, Parent: 6910, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6912, Parent: 1)

gdm-wait-for-drm (PID: 6912, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6917, Parent: 1)

gdm3 (PID: 6917, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6920, Parent: 6917)

plymouth (PID: 6920, Parent: 6917, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6936, Parent: 6917)

gdm-session-worker (PID: 6936, Parent: 6917, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6940, Parent: 6936)

gdm-wayland-session (PID: 6940, Parent: 6936, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6942, Parent: 6940)

dbus-daemon (PID: 6942, Parent: 6940, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6944, Parent: 6942)

dbus-daemon New Fork (PID: 6945, Parent: 6944)

false (PID: 6945, Parent: 6944, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6946, Parent: 6940)

dbus-run-session (PID: 6946, Parent: 6940, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6947, Parent: 6946)

dbus-daemon (PID: 6947, Parent: 6946, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6948, Parent: 6917)

Default (PID: 6948, Parent: 6917, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6949, Parent: 6917)

Default (PID: 6949, Parent: 6917, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6921, Parent: 1)

accounts-daemon (PID: 6921, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6925, Parent: 6921)

language-validate (PID: 6925, Parent: 6921, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6926, Parent: 6925)

language-options (PID: 6926, Parent: 6925, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6929, Parent: 6926)

sh (PID: 6929, Parent: 6926, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6930, Parent: 6929)

locale (PID: 6930, Parent: 6929, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6931, Parent: 6929)

grep (PID: 6931, Parent: 6929, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6932, Parent: 1)

polkitd (PID: 6932, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6964, Parent: 1)

systemd-journald (PID: 6964, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6965, Parent: 1)

agetty (PID: 6965, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6968, Parent: 1)

systemd-logind (PID: 6968, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7025, Parent: 1)

rsyslogd (PID: 7025, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7027, Parent: 1)

dbus-daemon (PID: 7027, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7032, Parent: 1)

gpu-manager (PID: 7032, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7033, Parent: 7032)

sh (PID: 7033, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7034, Parent: 7033)

grep (PID: 7034, Parent: 7033, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7035, Parent: 7032)

sh (PID: 7035, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7036, Parent: 7035)

grep (PID: 7036, Parent: 7035, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7037, Parent: 7032)

sh (PID: 7037, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7038, Parent: 7037)

grep (PID: 7038, Parent: 7037, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7040, Parent: 7032)

sh (PID: 7040, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7042, Parent: 7040)

grep (PID: 7042, Parent: 7040, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7043, Parent: 7032)

sh (PID: 7043, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7045, Parent: 7043)

grep (PID: 7045, Parent: 7043, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7046, Parent: 7032)

sh (PID: 7046, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7049, Parent: 7046)

grep (PID: 7049, Parent: 7046, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7050, Parent: 7032)

sh (PID: 7050, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7051, Parent: 7050)

grep (PID: 7051, Parent: 7050, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7052, Parent: 7032)

sh (PID: 7052, Parent: 7032, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7053, Parent: 7052)

grep (PID: 7053, Parent: 7052, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7055, Parent: 1860)

dbus-daemon (PID: 7055, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7056, Parent: 1860)

pulseaudio (PID: 7056, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7057, Parent: 1)

rtkit-daemon (PID: 7057, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7058, Parent: 1)

generate-config (PID: 7058, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7059, Parent: 7058)

pkill (PID: 7059, Parent: 7058, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7062, Parent: 1)

polkitd (PID: 7062, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7066, Parent: 1)

gdm-wait-for-drm (PID: 7066, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7075, Parent: 1)

gdm3 (PID: 7075, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7078, Parent: 7075)

plymouth (PID: 7078, Parent: 7075, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7088, Parent: 7075)

gdm-session-worker (PID: 7088, Parent: 7075, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7094, Parent: 7088)

gdm-wayland-session (PID: 7094, Parent: 7088, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7097, Parent: 7094)

dbus-daemon (PID: 7097, Parent: 7094, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7101, Parent: 7097)

dbus-daemon New Fork (PID: 7102, Parent: 7101)

false (PID: 7102, Parent: 7101, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7103, Parent: 7094)

dbus-run-session (PID: 7103, Parent: 7094, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7104, Parent: 7103)

dbus-daemon (PID: 7104, Parent: 7103, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7107, Parent: 7075)

Default (PID: 7107, Parent: 7075, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7108, Parent: 7075)

Default (PID: 7108, Parent: 7075, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7079, Parent: 1)

accounts-daemon (PID: 7079, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7083, Parent: 7079)

language-validate (PID: 7083, Parent: 7079, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7084, Parent: 7083)

language-options (PID: 7084, Parent: 7083, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7085, Parent: 7084)

sh (PID: 7085, Parent: 7084, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7086, Parent: 7085)

locale (PID: 7086, Parent: 7085, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7087, Parent: 7085)

grep (PID: 7087, Parent: 7085, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7092, Parent: 1)

systemd (PID: 7092, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7095, Parent: 7092)

systemd New Fork (PID: 7098, Parent: 7095)

30-systemd-environment-d-generator (PID: 7098, Parent: 7095, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7109, Parent: 7092)

systemctl (PID: 7109, Parent: 7092, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7110, Parent: 7092)

pulseaudio (PID: 7110, Parent: 7092, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7113, Parent: 7092)

dbus-daemon (PID: 7113, Parent: 7092, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
iwir64.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
iwir64.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1c340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c46c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
iwir64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x11fec:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
iwir64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x12863:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
iwir64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe716:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe908:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
iwir64.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x165ca:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
iwir64.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1b416:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
iwir64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12423:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
iwir64.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11322:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
iwir64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x126ee:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
iwir64.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1151b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
iwir64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
iwir64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
iwir64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6d42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6235.1.0000000000400000.0000000000420000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1c340:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c354:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c368:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c37c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c390:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c408:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c41c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c430:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c444:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c458:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c46c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c480:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c494:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x11fec:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x12863:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe716:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe908:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x165ca:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1b416:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12423:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11322:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x126ee:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1151b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6235.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6d42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: iwir64.elf PID: 6235	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: iwir64.elf PID: 6235	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf23:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf37:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf4b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf5f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf73:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf87:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfaf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfd7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfeb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1013:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1027:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x104f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1063:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1077:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x109f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6499)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6640)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6734)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6741)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6813)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6884)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7025)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6470)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6609)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6630)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6810)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6875)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6917)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6942)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6964)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7075)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7097)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7104)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7092)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.216.dr, syslog.132.dr, syslog.188.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53840
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: iwir64.elf PID: 6235, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6238, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4483, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4509, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6065, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6246, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6389, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6390, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6391, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6392, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6393, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6394, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6573, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6638, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6640, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6642, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6733, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6810, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6813, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6814, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6817, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6875, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6879, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6881, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6884, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6902, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6917, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6238, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4481, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4483, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 4509, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6065, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6193, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6246, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6389, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6390, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6391, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6392, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6393, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6394, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6573, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6638, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6640, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6642, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6733, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6734, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6737, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6810, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6813, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6814, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6817, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6875, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6879, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6881, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6884, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6902, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6237)	SIGKILL sent: pid: 6917, result: successful	Jump to behavior

Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: iwir64.elf PID: 6235, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/160@74/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6491)	File: /proc/6491/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6593)	File: /proc/6593/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6630)	File: /proc/6630/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6635)	File: /proc/6635/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6642)	File: /proc/6642/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6735)	File: /proc/6735/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6742)	File: /proc/6742/mounts
Source: /usr/bin/dbus-daemon (PID: 6814)	File: /proc/6814/mounts
Source: /usr/bin/dbus-daemon (PID: 6942)	File: /proc/6942/mounts
Source: /usr/bin/dbus-daemon (PID: 6947)	File: /proc/6947/mounts
Source: /usr/bin/dbus-daemon (PID: 7027)	File: /proc/7027/mounts
Source: /usr/bin/dbus-daemon (PID: 7055)	File: /proc/7055/mounts
Source: /usr/bin/dbus-daemon (PID: 7097)	File: /proc/7097/mounts
Source: /usr/bin/dbus-daemon (PID: 7104)	File: /proc/7104/mounts
Source: /usr/bin/dbus-daemon (PID: 7113)	File: /proc/7113/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6238)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6238)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6243)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76029uT8Mrr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76030fNxXPq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:761612vleOo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76169JNjlUq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76189GxRueq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76333nCRHxq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76336wpc1Xr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76455Fh5JFp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76493pUlxSr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76614TLXXhs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:76695hNagws	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:77930yAmLfs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:78014U4Q8Pp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:78036qCik5s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:78057dwzPNp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:78058VDXx1o	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:78082XCn85s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:78083Hl7HQr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79227a1FmDs	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79241xuHOhq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79311uAmwIr	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79394eylpRq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79581bGTCTq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79685gs7m0r	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79765hlb6ws	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79856SCUBus	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:79938JxHPCq	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:80037AB4t4s	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	File: /run/systemd/journal/streams/.#9:80180no4Ivs	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	File: /run/systemd/seats/.#seat0C2PpDV	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	File: /run/systemd/users/.#127XHwvRX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	File: /run/systemd/users/.#127KtrI9W	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	File: /run/systemd/seats/.#seat0ru4DCX	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	File: /run/systemd/users/.#127nKAyJU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6503)	File: /run/systemd/users/.#127W7A9dX	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6569)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6628)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6613)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6613)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6656)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6656)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6656)	File: /run/systemd/seats/.#seat0IseuKv	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6817)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6817)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6817)	File: /run/systemd/seats/.#seat0mO91HH
Source: /lib/systemd/systemd-logind (PID: 6817)	File: /run/systemd/users/.#127xyZcNG
Source: /lib/systemd/systemd-logind (PID: 6817)	File: /run/systemd/users/.#127yhev9G
Source: /lib/systemd/systemd-logind (PID: 6817)	File: /run/systemd/seats/.#seat0USZbxF
Source: /lib/systemd/systemd-logind (PID: 6817)	File: /run/systemd/users/.#127eFPeyH
Source: /lib/systemd/systemd-logind (PID: 6817)	File: /run/systemd/users/.#127KPt9WD
Source: /lib/systemd/systemd-logind (PID: 6817)	File: /run/systemd/users/.#127HQAwgG
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81325JU0zk5
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:8132670vE61
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81327uxawf5
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81339R8dlo4
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81340UU7s42
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81347esVuf3
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81356JX41U1
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81362E8eFY1
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81367VbmK74
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:81389llDXL4
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:82304MM6I44
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:82352Em30j5
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:82354X9saR2
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:82404nWRvV4
Source: /lib/systemd/systemd-journald (PID: 6875)	File: /run/systemd/journal/streams/.#9:82406QbYZ03
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6940)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6932)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:817662R9caL
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81767ChElAL
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81768TM8JsN
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81777TI1nSK
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81791NjOezN
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81792vPnlsN
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81793MXAEVK
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81794bDzcoL
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81804o2e2zK
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81834OLXwqM
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:81911TuOR2O
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:83981NXdjqO
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:83911uSCAtK
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:83913nFjjtL
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:85072UWLN9K
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:85087SGRLvN
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:85089xmRNCL
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:85235FJJNjN
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:852833G71yM
Source: /lib/systemd/systemd-journald (PID: 6964)	File: /run/systemd/journal/streams/.#9:85409VqsZSO
Source: /lib/systemd/systemd-logind (PID: 6968)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6968)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/seats/.#seat0Qt5NW6
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/users/.#127VVTWr6
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/users/.#127obJ2k6
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/seats/.#seat0uyOIB3
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/users/.#127hThOk5
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/users/.#127WJIz84
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/users/.#127xzYLu6
Source: /lib/systemd/systemd-logind (PID: 6968)	File: /run/systemd/users/.#127oiDY74
Source: /usr/lib/policykit-1/polkitd (PID: 7062)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7094)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7079)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7079)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7092)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7098)	Directory: <invalid fd (4)>/.config

Source: /usr/bin/ps (PID: 6399)	File opened: /proc/6236/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/6236/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/3088/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/232/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1699/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1335/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1334/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/2302/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/236/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/237/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/910/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/912/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/912/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/912/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/10/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/2307/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/11/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/918/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/918/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/918/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/12/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/13/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/6243/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/6243/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/14/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/15/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/ps (PID: 6399)	File opened: /proc/15/cmdline	Jump to behavior

Source: /tmp/iwir64.elf (PID: 6398)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6902)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6577)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6579)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6582)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6591)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6597)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6599)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6619)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6649)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6651)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6713)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6716)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6718)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6720)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6722)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6726)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6882)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6885)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6887)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6894)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6897)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6899)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6903)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6908)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6929)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7033)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7035)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7037)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7040)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7043)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7046)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7050)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7052)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7085)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6578)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6580)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6583)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6587)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6592)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6598)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6600)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6621)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6650)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6653)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6715)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6717)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6719)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6721)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6723)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6727)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6883)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6886)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6891)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6895)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6898)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6901)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6905)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6909)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6931)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7034)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7036)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7038)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7042)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7045)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7049)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7051)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7053)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7087)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6602)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6729)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6911)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7059)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6399)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6904)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7109)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6399)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6904)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6810)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6875)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6964)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6573)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6639)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6879)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6965)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6609)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6609)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6613)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6613)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6917)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6917)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7075)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7075)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7079)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7079)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6499)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6499)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6576)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6640)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6640)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6648)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6734)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6741)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6813)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6880)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6884)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6884)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 7025)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7025)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7032)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/iwir64.elf (PID: 6236)

File: /tmp/iwir64.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6576)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6648)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6880)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7032)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6399)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6904)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6497)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6602)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6729)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6911)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7056)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7059)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7110)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6243)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6497)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6499)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6573)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6576)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6622)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6639)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6640)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6648)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6734)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6741)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6810)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6813)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6875)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6879)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6880)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6884)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6936)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6964)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6965)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7025)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7032)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7056)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7088)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7110)	Queries kernel information via 'uname':

Source: kern.log.41.dr	Binary or memory string: Dec 1 14:29:54 galassia kernel: [ 479.102166] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.299.dr	Binary or memory string: Dec 1 14:31:29 galassia kernel: [ 574.153908] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.41.dr	Binary or memory string: Dec 1 14:29:54 galassia kernel: [ 479.102185] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.299.dr	Binary or memory string: Dec 1 14:31:29 galassia kernel: [ 574.153889] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6613)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7079)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: iwir64.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iwir64.elf PID: 6235, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: iwir64.elf, type: SAMPLE
Source: Yara match	File source: 6235.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iwir64.elf PID: 6235, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
iwir64.elf	50%	ReversingLabs	Linux.Backdoor.Mirai
iwir64.elf	100%	Avira	EXP/ELF.Mirai.Z.A
iwir64.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
raw.cardiacpure.ru	178.215.238.4	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.216.dr, syslog.132.dr, syslog.188.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	vsbeps.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	test.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	jzyKEkkDsV.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	arm5.nn-20241201-1515.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.24
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	arm.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
	sora.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sora.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	sora.x86_64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sora.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
raw.cardiacpure.ru	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wnbw86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vsbeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wriww68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jzyKEkkDsV.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	Beschwerde-Rechtsanwalt.bat	Get hash	malicious	GuLoader, Remcos	Browse	45.88.88.33
	Beschwerde-AutoKauf.vbs	Get hash	malicious	GuLoader, Remcos	Browse	45.88.88.33
	sora.mips.elf	Get hash	malicious	Mirai	Browse	159.197.192.166
	m68k.elf	Get hash	malicious	Mirai	Browse	94.154.174.144
	sh4.elf	Get hash	malicious	Mirai	Browse	200.1.79.139
	botx.ppc.elf	Get hash	malicious	Mirai	Browse	200.24.17.247
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	wnbw86.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
CANONICAL-ASGB	sora.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sora.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	sora.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sora.i686.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	bin.x86_64.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	tftp.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6633/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6945/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7102/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mSQvn:mSQvn
MD5:	F715B68825C2115C340A60B9A85923F6
SHA1:	9AA7FD26532410E672D7F950113D0CAB3B884AD5
SHA-256:	80ABACB7B358EDB37996792FF7DD3D120013A526F5352BAE78C4C74B8EA304D0
SHA-512:	C762FCA12062F00EE8B009912877085CEE24CDF782024A332B83DB89ABCDAA3303C59A53B408DC9B3FD3109C201729CC177618227A3B441E077DC0A1F8D80F5E
Malicious:	false
Preview:	7075.

/run/systemd/journal/streams/.#9:76029uT8Mrr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.544287119977837
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmocVO2aP7egrxsjs77:SbFuFyLVIg1BG+f+Mod7egrqji4s
MD5:	AF35C6D04D44CB70B004D70EE2CAA98F
SHA1:	B8A790B23ACD5E7D7FB65161B1FC57DABBADA863
SHA-256:	F894547141FC715AC4263B9C37249227C03B198CA6F46D244885C2FC634512B9
SHA-512:	56E9088991DCB6441D224F6DE1253758754A20A6CE6B36D257FE9CFD82A0163978CED065B624B0CCA9232FC1C85DCFE3C9A381CC375FE2913F47A332DA0A5236
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b7860f7828c441e3bfd318bddc359afc.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76030fNxXPq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.554151384283756
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+Rx32WRXK9mtTUYul:SbFuFyLVIg1BG+f+M+H3X7TUYuqji4s
MD5:	1C36CD3069C29A4ABA702D14EC1400BE
SHA1:	3C489796FC11C7A21042EC5AD921962F3964A3D6
SHA-256:	EE8194D4B50BCE248268371C173E7056F32392BDB4F6CFBD87DB49E9693C42A4
SHA-512:	C9941F3FBFFAACE449F42DB7974CB11670C8A6116091F26F0E95950B2778DC3FFBEFD5A7DE1B6FB8412959F494F18B1FD02A8B2BCBC161693AEC3C403CF0DE4F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=42db481349b348068e757102d55a7161.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:761612vleOo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.369772433074462
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9AXvS94cR0js1Had9:SbFuFyLVIg1BG+f+MaXvSeJjosQu
MD5:	0F75091D8EC0C8FDEF454E52460149B6
SHA1:	92C4F4B9B11C438596123DC8F024742C834A7A67
SHA-256:	12BEDA2F70A2DDDBD74AAFC4A1E3CF33F0146D058804D4A189EE00CB32FFFE50
SHA-512:	3B918C5A6DA0200943EB68B5434FB91332CE465109009BD4838CED3723BE4392FB50DE9D1AAEBBE59C7A990AB0C7A8B23C149EF9C7E2451D87A4A089E7214948
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=734bce845eae4787b7d9c75a4c5c45c4.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76169JNjlUq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.398395544839502
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvDdS9RT6EBQmIjsmM:SbFuFyLVIg1BG+f+M8zzByjdCLKzK
MD5:	DAFB9F6B56CE96B801ABA77CCCABE08F
SHA1:	3592DDDD405C186CB6988947820DA04DBA79D620
SHA-256:	7F0FE38D01444C548E01F14192B2C3AB1F0267E74E8E193FAD3BEE545D331823
SHA-512:	DA56C5374D82BCC2774089E9CDEC095A22CD93DFB111B13698DAF268AB90E65639D2150B528B6F061747CCE354F61985437F79B512E8EDD8DE1FD75EFE699102
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec1870c946774429a28f0b4a105dc646.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76189GxRueq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.386063931562412
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpUFDOWwsjshQJWL0:SbFuFyLVIg1BG+f+MA/jtWL0
MD5:	E7FA13077EC0752C7FED889A78250F51
SHA1:	34DA23AC4F02F15B07B802428F99A3C28A267FCF
SHA-256:	90BFF5CD84934B97EB0F7C0631676B3566618D42F8353AE10F0172AFE8B85A75
SHA-512:	7F71E39FC7C0DF3C801831089B2946145D954887AA70814E6A47A718E577051403AD1866869F551979B3C69F2B77EAB8266BF22EEED3D961A52431EF5639E080
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c408836213bc4cf5afd645c889f178d0.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76333nCRHxq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.506011063295491
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpOLUejAqeJhF2jsig:SbFuFyLVIg1BG+f+MIWqy8jZcHcljX+
MD5:	ECCC9D9B6DB1118760959F40134F269C
SHA1:	CC15082464085840DCB5772E3932D6A117002935
SHA-256:	2BB318089236C9576054277C6F3228EF9FBF36A2F533F634D6004C775A9D41C1
SHA-512:	25A7B5DA38E22BF9CCE6277292FCAAEBF88C0D742EF03044E39F2AB1323CE06E4B54F4B56F0F53C6560FABBA2FD6CB417252496FF6BBF1F73BFD6B0D933A6B6D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c67a9f17cb7e4893827e85539a1f0879.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76336wpc1Xr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.414895066520792
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmv5DLmoxaW5k0ZjsjF:SbFuFyLVIg1BG+f+MBzd5VjNE
MD5:	C1E2FD8E201582F418A6734108F0B1FF
SHA1:	2C44BA50E4DB1C0B3E3626EEBCEF89FE61206E1A
SHA-256:	884B5CDAB6501EF2B6DA1B70158508DAB470DC737013F8D613B679E1FBD2C2A7
SHA-512:	E15CB8678D72E5FB84429B21908946A81CB27C577B782F9239EAF92079580CAC9B35A8BA9ADCBBE67A652A504DEBE2F38BDB2F4E5F47F4DF112D5D2EDE014F1D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eddaef10db9f4ead815871b2d93a5706.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76455Fh5JFp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.410057050322663
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmorGIQ3Hh3xXXQBASW:SbFuFyLVIg1BG+f+Mo3QRhQBbZjbVC
MD5:	AC3EFD52B2956BDFA5B99CC608C91A8C
SHA1:	352D4A78EC405E80FA099592EC0AFEBF03A7E7A8
SHA-256:	F6C11A32F7952C6B05DC87C1B01ACC9FC049174BD07AD0E2CD9F94C0A99F235C
SHA-512:	54CC97277B94BABE2A18FD9AE1DDF2A95B93F41395FDC8CDBFC2C7C40C95DF27392C39D48A2654D61D520F01F7ADE86428A7F864EC2A8F213F18D613599588C9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6f6ca3e5ddb4b7a81b3822b540d51ed.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76493pUlxSr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.374776436847116
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoAS8Ik3Rfg/A+sjsV:SbFuFyLVIg1BG+f+MoAS8IkhPjLkGq
MD5:	0B8F475B57DD4A3E7187CE20E7F4E0D6
SHA1:	284C7180277A17749315714E7B49453B0716B4E1
SHA-256:	B093D1D74BCC92EBC37B738DF61BB1664F5E35A21367E04D32845CAD34A010D2
SHA-512:	BE72DAC050C62B7F93ABE342A8282C713F0A8EED7A7EFD8E21C46BBD69C95FDADD4FA6615E2A269CE6D0FA9A9493834199AD53B5A6995CF03C141B7C2BD5B497
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b3b561d5b65d46aba7a41cedafb5a542.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76614TLXXhs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.446568493505089
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5YNHxuVTQUQ2js2ALAQ:SbFuFyLVIg1BAf+MwRacyjNALyAZD
MD5:	4B8E440EDDE210F4169FDC3FE7A7F463
SHA1:	873E76372E3E1BA39337D1421D1E26E315DCA6DD
SHA-256:	B052FAA995F6E201062413A495EB54F18E527D06953DFB7593AA17AA6EF43420
SHA-512:	B0098FE85E59F84A4334DC57ECA5E42F152B433B87EDDA056E5EC6FE4766B6D13C992E5B3365A0C85C255D987BD4E525EBBC88FE091888FA59EC36BEC2C91AC6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=316d6b3fabba4b9db88c0f5756a2e53d.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76695hNagws

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.475312859012584
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MsgQ1tqR/B5qjNdQIeXD:qgFq6g1af+MsV1YR42D
MD5:	307C14D619B6AC6012D3D1813C56C8F0
SHA1:	F1E8979A633346333290BDB56FFF34F808ED55FF
SHA-256:	99C470AECFE5DA7C3FB2A71877C7085338B9F90F90D2C555102B7E718D70AD5D
SHA-512:	5E2E05915BE2569015E76DCF08565EE16D2713F385D9B999C1BAF2CA8212B23CF08D602DD60A41FAD0FC813EACEFE5CF3406159728984F517EA9891FD777B9D0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f94560e7065a471582bfaa6452aed3c3.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77930yAmLfs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.4599737028184725
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+O6WAA3g2jdCt/rRMtq:qgFq6g10+f+MqAlCDL
MD5:	B12EFF61F29789E863A8EC861447F78A
SHA1:	4EB4C1167CC035A572FB00AD427941BE633F08AB
SHA-256:	19453E0B27CFDC5271D33A51A966CFEC702092130A8B9BF74F5C0F9657CEA45A
SHA-512:	258776464474524C22CDF43D168672C86A4F355ED89DDEA568FE095C32DDE8AF09CA1B6EAA22F5A9E1B6BFB4ADC1AB1244B7BEB153AA982B96890739FD9FFD0F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4e20fb4b6cd047258d3b1c3450630123.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78014U4Q8Pp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.423871494448729
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoBpSecZSUHKT2lsjs2R:SbFuFyLVIg1BAf+MoBpisUQ22jNTZD
MD5:	68814194ED326E004D7723FA823AD300
SHA1:	725D03708C5B836BC12373CA15E55AC89CAC1385
SHA-256:	404F2490FCF9EE9ABFA669246ECB717FCA5D40D0BFDC7AA24B161C2FE7BE503A
SHA-512:	5962C3164A4EEFA1D4DEECD6873CEBF2E84131D620354A3214FD1B2F5B9EB3868732F4ECB1CBE8A83C9CD6BC595A92B1624DAD81C6064F2BEAC2D821F24567C4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bd76deb6faf4437a9255671aa2816823.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78036qCik5s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.449781350844187
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu3iRxYScF2jLTTIWTIL:qgFq6g10+f+Mufl6EWEL
MD5:	C6BA78FFC487CE1ED9CC1DD73F41C665
SHA1:	8E60F33E7CEDBE396EEA5CEC331D994A83DC1D47
SHA-256:	2ED1F282B50D7A93FA1ACDDB1F98C5597F55267D07DC68453FBC3AD3145C3858
SHA-512:	6DEF77521F37E9EBA21AB8B7F5982AF97AD4BAC1995C386ED464161F5FD4D83263960BAE8F3215B4B2D5619B9EED526EDFBA04C3919D18694575AF64E730884C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dbdf86b344374326a1384b0ec5c1b785.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78057dwzPNp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.385734332315503
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm54WfRFiswsjs2BI:SbFuFyLVK6g7/+BG+f+MiW50sZjNq
MD5:	2745200E4E3F441086636D6C7EDC0DD0
SHA1:	CCC8723597A87D491904B70D0E09201A186B08CC
SHA-256:	BBBB8111BA50D3BEA7B2F25A795B10633002CCBD92437A1A87B413343D3D2590
SHA-512:	334A06B7B81D65EA95374C83C40564164A2FA794AA1FB2C7D5EDE924C727C22907098CE7BA6D5730DA49A1D2ED44664C25CFE9DAD24CD81EA38380C68E494F7F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3fbceadef7f34551a53463def20adb60.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78058VDXx1o

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3742027934668535
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmr3Kd8EtVnC5xsjk:SbFuFyLVI6g7/+BG+f+Maj3jNq
MD5:	7C658BF6B08C9F5BB2E72DEA9E21821F
SHA1:	0D4887FE52579CA0E2068CBEE7F8155E578BD5D8
SHA-256:	D7A56B837EB01FE5737C26A39B5D8A7C366D7E18551C4A4E5CCECCFE570011EF
SHA-512:	1F743AD756D69D13471F4DA8E4C7BA0EE7D8AF6055F1A8B8851DC5E336EB213AD01D01C2EFA64E1647430D588322146761431CBC5B0CEB9A789980F9E03D4746
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a0850babc39849b89b33f7ed0ace87c0.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78082XCn85s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.470904890087159
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MyG1y8jFQMzKaBu:qgFqo6g7/+0+f+M7E2Tmh
MD5:	FF08DC35EBD19EF27A268C10309D1FBE
SHA1:	E0B37522C2A8062C51EB46D3665A1B23403A051F
SHA-256:	831D56785457F1C9A6B5DA97FBD7DB46F45484672ABAB409716D2C2838D2AE4B
SHA-512:	E8D0E88F4A36A1E87E81254C642A5678B6CEDE07024EBCBC2E84D566AD5406817F218D61CB48A957A0C8BF43B0AFC227C2F2BCD2E608CCD97C304FB86596BA49
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83ddd38630384a929a6e67831a9163f2.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78083Hl7HQr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.52777145441981
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/kDIkchbzZjs+QD:SbFuFyLVI6g7/+BG+f+MHhZjFQMzKaBu
MD5:	33D42B7FA6ACEC5D3A6F8642E3D5E9CB
SHA1:	64D99FE91346D9141813C09E1BA316D4DC71E8B7
SHA-256:	58CE966FD01D353BFAA7E768B328CCEC1474ADCBFA65E928B89E7174E30DE7E2
SHA-512:	B0EDC745AEFCDB5E0A9DFCB00E392F419F548FDA19E80D9FB62F0C5507F617F6C118E2EEB2091D392C7749D6A5574C091C8AD497AF0FC6200A95B53AC2BB3AA9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5d1b5b76fa9643139385f89765857399.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79227a1FmDs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.368679321057977
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8O74+IYGRjdCLKzK:qgFq6g10+f+M8O7RITCLAK
MD5:	2372E00D83F37EF64F6FB4316CA540A8
SHA1:	E89556072BBAEBD9BB2600F4654D5A03CFD89F6B
SHA-256:	4DD7E33C86F65291156BB7F06B5E372693AA19A1DA4CCAFA6B2D3D262ED417BE
SHA-512:	D79BF7D51DBC241A4545578786BF45AD484A03F1B17EEE7EE083EDC6AB4A0F865956D9CACFC38D2F57E6A1B2F52DF0300A551BB778539C81C2F7F38610081C0C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=65773f5b81e0438594ea7e71de98ac07.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79241xuHOhq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.408700073123465
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrJdEaCtF3nBUjFrqd:SbFuFyLVIg1BG+f+MnEaC7nij8josQu
MD5:	B9B119065366EF96119D154A01693874
SHA1:	35D4730DD43975512CED15B0F9BCAFCADFBFCDEC
SHA-256:	841B14E380FFAE7F4FB48F0A962069FBFE1EB8D68D01E5F863990B1345432145
SHA-512:	65CD395C70850F22AF6C8F0B9F44B80117B4297A1A61CA9016073F3C4805C2FF5460E2F83CD72DB73D4D9AB3F1CEFA09FB2B3D77BFE641D059BEE91FDE424227
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a32988c02bed48e48d255340a71d3a16.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79311uAmwIr

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.439290917083142
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsUy3d+tTrHjUSlPR/:SbFuFyLVIg1BG+f+MsUydWbt8jLkGq
MD5:	DACC2105F6BC62B8716D1F1355DAB110
SHA1:	D8EFC180C89D5436E8B99FC94C565CC18ABEDB91
SHA-256:	9B67EE3188186522F16508EB360D07524CF4961676B879D3EE8EC2CDDCC2EBD9
SHA-512:	DCF54774147671A9F02E1C9E0B0F6F1CBFA1AA9031FF5CFABAD035EF05D6755A83B9BB6C202DD92900F3473BCCD9381D4F545E5A974410D77EA165865BE2A814
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f8e2108fdd314a2996554b8d9c17440b.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79394eylpRq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.424293727281391
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MaQxA6gHd+diZjdCLKzK:qgFq6g10+f+Mashg9++CLAK
MD5:	B0D707682BD1BF131329640152CD7C77
SHA1:	5B9A842B6E89151044A4363229826F7348CE5F5F
SHA-256:	A6E9C3C630BA583D3BE92081EE2B122F07AB180A1A15C40E73283E6A4D5C366C
SHA-512:	BF49A37F3481C7B5FFDB17DC79631E3B832A61A8AF2A2E9226D8407706757A90DD8CEE847A0A0FA2ED11144D28AE8B71EBA05255C03E3C85BD0A7BF2F5736B2E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7255dcae456f4c47b1662f8b898a1dcc.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79581bGTCTq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.509252170214568
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mz63QVAqjZcHcljX+:qgFq6g10+f+MARkmAu
MD5:	E4F72DE4249ED92402F7435AFD858ACB
SHA1:	A1EF8FB9866450FECF1457F250012D938722169B
SHA-256:	2080E35AA4C49867129ADFAF57A9DA7BB00CD17F650D5A95C0B1C785D929308A
SHA-512:	E32447EDE21CD18EE7BB4417561472B46EE6DBA0C2FA5502A8173B252563618DFE2D70FE8CD684AB77396AA6B5BA24A7014D8C7350EA6CC28EBB307D81F07285
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=976f503f6645412dbec5351d582e22c9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79685gs7m0r

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.440563136701089
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9aHFWESRxAGN4v8js2o:SbFuFyLVIg1BAf+M2F4jNRjNALyAZD
MD5:	F42F1121F3234F2067F27E6111B32364
SHA1:	DD412BCC37718B5FFA59752887DADC8EBD7512A2
SHA-256:	DA578490D31EBEF0283BBB8343E4EF5FCA622287DDF5655F42007B9681A599AC
SHA-512:	6AA85B1E999B927BD04B539F07B4CD72891739D2C2E72ED004EBE1846247651C83B118ADBAF91359D429F9EE8604AB380A65628CCC48FA8151335519482B46DE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d76b8a738c745b0a8ec52577930c848.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79765hlb6ws

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.456342508478656
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpUc0DHhud8Wdoglsjsd:SbFuFyLVIg1BAf+MqdHomg2jNdQIeXD
MD5:	1625BCD015E7291AE16386D85B74BA9F
SHA1:	EDB45FD3146CCB0321B45E10D2C7E438901A5A8A
SHA-256:	13FB0D8BC6C92CC1EFAD938B903633D6FDAC221602962E1BE7177817BF5BF53D
SHA-512:	A907B634AB5C569E9B7FBC0BC1D22A816B1F05D9C25C7F82298990A152C302045363DF386C29E6E91CBBC7E27A7D6680B566E8BE6B66BA9CB261B83C6D661DC7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c1008afcea3d456fb22db78d1a033642.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79856SCUBus

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.427149471449273
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+UKRT4vkgw0wsjs16:SbFuFyLVIg1BG+f+M+nyvkv0josQu
MD5:	1A4AF742B87C47C1CFE5D149C108BE39
SHA1:	2D3CFD6F1461C2B70895AFA82FCC9D01224686A7
SHA-256:	0DFC02C5CF33F1947D5CBF2E291E7210732280F3F785250334A88786BF8BC74F
SHA-512:	A8631ACF2BCFB487121E594A37CFD84BD5370E6BB07BEBD48854771E66B51048D648ACC068D469B4524074D3E6388D1D40D5BF7D0121608590C5798E45109141
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4903a57233294d468271230c2c7276dc.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79938JxHPCq

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.36632247011724
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/4HqXBEmAwK+vXsje:SbFuFyLVIg1BG+f+MgHCZv8jdCLKzK
MD5:	6BEF0CB2D5D7BA604D22425BFAE3DE52
SHA1:	5693BD5EBB15EA3326316F5C423C11B37379DA26
SHA-256:	62E954208162F93D082399FC2D715E0CC97137B377103BD488D38CECF07B3855
SHA-512:	83D3FC9527E0E277A91B6774B9325194BCBDCCA7A24041904A5BE58F2357AF5B33A782855D36A3EC0855FD0CBA0432F1F1081C2D4A8F62E33E48354715EFFF35
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5e8b19a0ced5471d98ee0c81927d2b73.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80037AB4t4s

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.323551193970741
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/ngVED0BRxyXU9A0d:SbFuFyLVIg1BG+f+MPgM0xLXjosQu
MD5:	D5251230CD52ABE76C7B817BFC7AC186
SHA1:	8A96D6A3555912CF0A460234CDD2D9DCA0E58836
SHA-256:	A30E2FE19ACB554413CECF77354981CA614587CC455E078F757D4CA0A469246F
SHA-512:	4904B7C8655A123E0411DEC9D9BCC1A9B4846B1172338C3AC884E29D6D64D400C623565FC9A41D16C1524186A1BC339D22F7470B71D684359635A930D9AB5F7C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5d1a4c0afe4d4dbabe4e8fb2bde6d0de.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80180no4Ivs

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.440809963929747
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MJRuAH+ZjZcHcljX+:qgFq6g10+f+MLezmAu
MD5:	2B3430A246B8ADA872C33409F76C92ED
SHA1:	808F8CC5EADBE7180F8133B55996C133C8A6DE2C
SHA-256:	F29723EFC8912D0BD171CC31EBEF50C23BED6CE836E38C449B524451DB2567B2
SHA-512:	4EDAD6B6992E4ACBBA92B535E547FFC917AF2FD4C240A28591264CEAABAB242CDB989A23FF9DB30E40760893C3D7AE9B9DBD5A670AA6C366F0D6A471FA20B67D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=305edd99482f4fdab2e0d3633addfbb2.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81325JU0zk5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.496610283898243
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6KRzVBTu0Ymqji4s:qgFq6g10+f+MhRJBq0Us
MD5:	0808712EF4E2FE55A39B606E015448F3
SHA1:	CF7AF871D5221A878513806378268BC6DDF96A00
SHA-256:	D53524A113216F2D8749FE2BA4450CD8BFF866FD256FED053FA04380C1EF542C
SHA-512:	7D5E9F763F23B07D5AD79F411EED2B89E769CCF6C032D9F3173D07322C8DDCB2CDD897C7FA233E92B91373D4935967D45154D480DE17B2760BC7BA19EC603125
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9631c42d0c14bdcae88ddf47dfef4f1.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:8132670vE61

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.402225984657435
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzAQRdysWsUj6jsmNm:SbFuFyLVIg1BG+f+MMQHly6jdCLKzK
MD5:	C01F3A4457741FC3A7BBAD7433D06469
SHA1:	0F6D91E482874A7E7BF97A04FCB9BBDDA1E04139
SHA-256:	7C971CA67031E6B1B67B052A83A5CF72E1F872A1E689D6704A7A605782A76751
SHA-512:	1095A6D154811EE3F4CEF288C53893CC9F7687B93EC7B49D5E3CC8E50285302ACA72CF8D41BE531AD3FC539B0935779A772F7E08E0D3ECCDAB733BBFB2AAFF0F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9df58b695a5c4b8598e679dd982abf68.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81327uxawf5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.401531264160353
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9zDAghIsPABNlsjsc:SbFuFyLVIg1BG+f+MVPMB0josQu
MD5:	45CA3BA9274A21AA428793E6E9ABC74C
SHA1:	411075C7B1216AE2030F449074A24F04F7F84DB0
SHA-256:	9EC6241E0CC09689F75EC75D28C85D3D64216056896F2351FBC535B6130A501B
SHA-512:	881E1D5EC1533D1D341A8278A3427B443437C6471BECF367379D4120A6160EBE50E5A4136C6C2C169ACC11003004145287B9F9A0C467B3D81CA1A4D7AD5B9B2B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a055a7f692e44b5956a99357da56e51.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81339R8dlo4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.467682865543084
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrh11GxBXVlUaTjsig:SbFuFyLVIg1BG+f+MUbLHjZcHcljX+
MD5:	C2B466FE52DF1C42B5FF6D57EB056773
SHA1:	6737DEA73DD649DD9ADD3C458520639F7574BF4E
SHA-256:	429FA0B4D453C7E1853E8B1C04E62073E5D51BBC46F07BE41E579EFC3BB3F05C
SHA-512:	411B3AF933965876329E17E26CB62A3F34D928E0E767097E50F40B965E0FB3BD490B4CCAE19C4E5314D2D683757897C34F5FAB3BE0381A1D16AA887FD193FDCF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4bb0dd46c42470da2180f2963f4a106.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81340UU7s42

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4093735203210045
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5RzwUnTGEXd6HYgrj:SbFuFyLVIg1BG+f+ML5KzYgrqjdCLKzK
MD5:	52C00AB1EE9B73985AE67024725B007A
SHA1:	4A326B3E6F6B33BEE977AF0420C452A5A54861F0
SHA-256:	7D73721F009B8FD1286C4D43DFD1B668229736014F8096F8D3CA4E9502C718EB
SHA-512:	E71D8C1BB488E7C451873CAF1C9BA7C8DB2961A0456C9633F8FF637045E087FAF239A1515B7C4AFFAE4076404977DB39D8C026BD05B1F459B55F0A9AE2ACB557
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=32db319d17f1492786cc69328a66814a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81347esVuf3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.41372755563728
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsBEdqBHRjK26RQd5qj+:SbFuFyLVIg1BAf+MsBEdx2d0jNALyAZD
MD5:	6EC533C5CC5F592800D6C3A785EB884A
SHA1:	1C39152C2B92306926EB6FE75F7D7A2D1D5BF6FC
SHA-256:	C3452AF61873D57FCE0379E186225CD7EB9AD39904FBC6994F5380856A72CE98
SHA-512:	B7AF705DFC8B70D5F2C6E203ABA9137D6804A42443590E3CEA619EC70F8473B8FDB16B7A9BF4676B018757ACFAD2EBA0B607CF3E63B98F6EC051F254C69D0626
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fda8afdcc3584506af392c28f2c05458.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81356JX41U1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.371022979870546
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm90BflBwcUbJYTjswK:SbFuFyLVIg1BG+f+MatmxJ0jLkGq
MD5:	B4CA87E66AE4C78E49E6CE23353B71C0
SHA1:	9362F305E996874E4BC36A237D8F2078E09DD984
SHA-256:	DA21F6370CE465F72E758D4837F89B37BB46718FE85BEF2F497710376BE4AEB0
SHA-512:	B18F2CF6BB6413B017370D709F4A50B49561F4B052991B3B4C38B21965619A6516EFF9ADDD450D95DA4187E82B871666E5CCCFA93B587054417F69A5D3965521
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d12d1a891d541bea1467f10af0babae.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:81362E8eFY1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.443957778373979
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyVBVHdnRTUc5TEJshTA:SbFuFyLVIg1BAf+MyVB+FJsZjNdQIeXD
MD5:	4098340F54E11852DF360778AC557113
SHA1:	5A181FAE4D9C9DDEB85DB22DCE67217A419D7452
SHA-256:	49DD418A78FF12C698102958272EB5D932FE9B3BCFE21BCC09C7D1EDB7C3F25A
SHA-512:	7A89D94AC92D41BC4E7CF3F51A53C383530148E210567FD1AA27B9106FA87184B2C9AF59B0FF4CA0A8363DE97103F1864E151399BB8203C4415353DC8EC5E4AF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8765d006608d446195307b3064644184.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81367VbmK74

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.392180507079599
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mw1idLEtclDGHkjNTZD:qgFq6g1af+Mw1gEeDGHmTZD
MD5:	9156DB0A7F42EF57275A329554CB29AC
SHA1:	5D6322774A9D63929E28D2117D8F69AC2FE734D8
SHA-256:	DF53CB406AE1D5CEE206901EABC6ED72C7FEAA850DF9C8012F22EE30EFCF3E1F
SHA-512:	99A392FAE25A4E8BA28725327FF0E4FF38DE34E44667E09E464558F1DA8FD2F992C14EEECE088E4BAEDF0D0365EA40EB8D0894E3F5740059AFB779B862129B22
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eadfe535d1874823a99995af5f3d71b2.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81389llDXL4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.428623553136108
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MurVW3cc0U2jLTTIWTIL:qgFq6g10+f+MSV80DEWEL
MD5:	2AFF86697EDFCAEBAD7C783D5A88571B
SHA1:	C9978908FBE33CFCFA3F3599A3883BB5CDD43F2C
SHA-256:	3783DCD86CA76E3C1F085972191D5E584890374BFB8FABD69435870AAA655153
SHA-512:	5E14C6D15F2DEF2B1A5C96BDCA05E2808D1CDE81701B7A7A1D5002A8882BFAAFE600EEEB4D969E8C961B7F1893CB7F846E90C703672BF39ADD5B175424490AF3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1db5e6e76534bb49a1df9e7abdd3329.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:817662R9caL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.453767438322082
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy/8sLhYJX3Q0jsicN:SbFuFyLVIg1BG+f+MypLhY5jZcHcljX+
MD5:	47CCADA8407F3DF8D661068C8D3DCFB3
SHA1:	57C4227897ACC71B84689F29C145821D21756A02
SHA-256:	B00616F941DDA77B56E44F1429AE1302A409CD6A2DBD212A48DBDDFA6AF1921F
SHA-512:	5A0B274FB890BF9DBA5FF05FEA336FC455BD5ACE5AC9FDDFF0673EDEA5231C3716CD413D1CA4FE15838218F5C1A52C46ACE8461F228BA7A030582BDB60812957
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=800a0658a9d44459812602d0dae7f145.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81767ChElAL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394843260843542
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7UMUT9WdRUMedMqje:SbFuFyLVIg1BG+f+MgJWTUMjqjdCLKzK
MD5:	A1376AC4873FDC8791825D2ED818800B
SHA1:	8F18F6E814A476DDE7BE26E76C24631D60FFFCE3
SHA-256:	3F29962D129420DA0449535805EE466746C03B9D78F7345D5EBE9A9AE6F0B0A4
SHA-512:	BCDEB28BFE6072DFC441CD1EADED26C69F3395FAC4803457458D459C9D7126827EE7CD81F876015E1AD1E4AAE9DFD7773C09E3C99893347BBFD7A6450DA956BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e8d01016055426fab84ca5e7f589d47.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81768TM8JsN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.386741123736227
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GYx6IsKxBfHGxp9v:SbFuFyLVIg1BG+f+M4dVd8pm0josQu
MD5:	3E8DE861FE7AE528F51A09B84FEE54CF
SHA1:	425907321FEA26F49A1928B03E8DCA864C25DFE3
SHA-256:	F6774B5BA890526105C320EDABA858822CAA5D900C5F712AFF29B2E79F0E47F9
SHA-512:	CA23C77A5907AA20D3716FCC898329DDBE023915766E62BF016E137E441E0CB8AE211B8A16D73A3EB7571C98DD3B2D3F8767B48974820ECACB5D50CF65CCB332
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2cfa9ea65ca945cc8e1d53fbc9eaeb8a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81777TI1nSK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.34723023679226
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmurHmtZRSHW5vF2js4:SbFuFyLVIg1BG+f+MuyZ+W5v8joa
MD5:	5862DF2055CC8569F636A41EA6D1160A
SHA1:	CAEDF194357FCEF2CAABF967B48160C92B7398F4
SHA-256:	0667A339A71956E3FFC06033B9E2B2510572754C7D23B5E7E7D9294EAA2B241E
SHA-512:	011E64B0609EEE43BB41B1B5BD937C117630F12BB83758AA11C28FB6F1CD87C57063D5F5A57739749F8045CBD22735436F3A9D3DE5870973BDB3E07620EA2230
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc45f2bd43bf4712a1f3f1cf147b31c4.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:81791NjOezN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3353802539135335
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm56OBAHAouHAV+sjsO:SbFuFyLVIg1BG+f+McEK4ajtWL0
MD5:	3426DEA79F435B0A4D2089711A8149C0
SHA1:	1A9B9A3D3DD0D61B51E8693748EE0839215440F5
SHA-256:	7796FDED11AFD71DFEDB5DA5DB4BCE71AE6228D12CCF22F57522B948EA5F239B
SHA-512:	CB83BC848EF88299277FC6AAC8E518F26E1CDEE42FA19646D2FE21520EA8EEF5E8A0B186C1D1C17DA98A9E25786E7901B953C13167555BF6283C6E54874D1657
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=31d212e607eb457babad9c94161ce2e1.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:81792vPnlsN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.439585490828253
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4DU7GXB3+sjsjOdlE:SbFuFyLVIg1BG+f+M4MWDjNE
MD5:	40DBE56626C6E2675E38711FA00132BA
SHA1:	4E18F90D1686082C8C8F300D54132D623E2AF255
SHA-256:	E87D272E227FFFE78F56C229F50E9FFB5AC63FD713AF4DE7FF302BD60E3BEC05
SHA-512:	F155595CAB771CDC9E01E1C5A789C7E48AA7CA876FC17B11040D00024CBE310C8EDF1176688BF2A0574B37553C588039A39E13A875A18D799BC08CCEBA34C3E8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=23a1cd3197ef462ca0fbc2351b294423.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:81793MXAEVK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.422589624744816
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MyTDZzx92928qjNALyAZD:qgFq6g1af+MqDvR8wIZD
MD5:	2596EBDBFC2914E3C03C32E59922ACF4
SHA1:	B59A56A6EFFA29434BAEED227E70D881AA4CC590
SHA-256:	B67474D2156D13EBDE9020F74C490B274B07125B6784D640491EFA5865A61D17
SHA-512:	0BECBF6C47E7DDFC2D6D64A221E87C1BA1AA27E320178BE3748499B8F73D98702B00D04C80A4244303EBCE8AE7EE66BCC34E10003738E822069654C3CA83B5E8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8ffc9fc2d5b849eb854a50f0ac253b3e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81794bDzcoL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.442316455454795
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+8jXFiCdu+sjshKJg:SbFuFyLVIg1BG+f+M+MXMCdujbVC
MD5:	1245A3C8F62C8B786BCAFBB9787F4DAC
SHA1:	507C23569B374C9F956BD803F7BC0258E25EA3E1
SHA-256:	53455F7D2564276CA35F6E0BC33AC2470EA90FDE6956CA99A1571A3701E83E55
SHA-512:	F09F56E15B2372316F57A35889C839C646D5625E0E769AC83A3D042B9931A67D02FF28FA141B71C5C9C2E2CAB051237B060A7724D675A4D28CAC1B588AF181FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=47e575269d97420c92b96e165b8fe8ca.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:81804o2e2zK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.395168623963395
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzHTHB0sAAZxsjswkT:SbFuFyLVIg1BG+f+MPHKWUjLkGq
MD5:	C05240011FAC19CE75266CE64063B46E
SHA1:	F5676CE617251469D0DFF685B48E9A0C82BACFB2
SHA-256:	78AA44BE5A64A780CCA0FF63D4C234E1D40A69FC84DFC2C2602535BD4798F95E
SHA-512:	3F9C855D106F0C9C1EC48740F243716DACE234AA3FB359740B9CB8C7A27D7C84A7CEDC87E0CC0578801E6E6FC1D60E88A25B9F9F3F7252C3A4922007DAEE4D06
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91696bd3a3e948e483697b1f337f9eeb.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:81834OLXwqM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.440764515692861
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5525Fcs5dL2rqjs2BbM:SbFuFyLVIg1BAf+MsVzMqjNdQIeXD
MD5:	1205F87BBDC7CFC88E5E526D529C0B69
SHA1:	4833DC3946598F773DA125D0C5A5166021B0080B
SHA-256:	8A16B3A3E771981A2832C1C21CD0D2E9B3D7B88FFB73111D34A2151785477C8D
SHA-512:	F8FB114E959C10EF8193BCFEDBBFF789C19D33B6EF8388F66C1CE187D5BD0388F1DCDF35F3006EB32DDD82E05BA5533EA322B4B3609935C9862844C5562237E4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3e9ea17516e845c692210531a1a75c55.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81911TuOR2O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.406234434125478
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmp5TUELnQkKj2js2BZZD:SbFuFyLVIg1BAf+M0ELQB6jNTZD
MD5:	A6116C1CC4B3248D0764B7795854E66A
SHA1:	3BFCC3EFD63E555DBC9F4C504D9D38FB50F2F11A
SHA-256:	4320F22D4B16BB852FB1FADFFC0E1C2228B135D135527C4A1D9AE0CB558190DE
SHA-512:	CD20931D6A07FC075565B4D465F85801DB81E269D6E14B64A2D14D4FDFECB1894635EF5007C682DF37035C0AA561D0A38C88BD30A2A395663D7CBF845454AC19
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ca561787cf8644d595ebdaf0664d16c4.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:82304MM6I44

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.410043665138962
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyU06wzNgnGUDm/Xs4:SbFuFyLVIg1BG+f+MyUxCNuGUG8jbVC
MD5:	7906AB21E497620E43A77D9E523EEBF7
SHA1:	2C473B5564EE5A16BB587354894BD9AC0FCBB383
SHA-256:	578A6C434B3CA88A1035EB416F12B24E2514003C1BF9AFBC656477602C27FBAA
SHA-512:	FD40B7FF62779F468676473F8585B4D02C83BB22EC9A1F13FF701B3F8B53338EB606502B1F1B3E183C3881DDC75CCFFEC05EE6ECD7D0A98E331C0ACE1FF84611
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8cfc0ebc6d054090bd11764e5c126ef2.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:82352Em30j5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.441102186070015
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrHFMlxmGdfAglsQ:SbFuFyLVK6g7/+BG+f+MZMjbfATjNq
MD5:	73C181A88D503B81954159EEFA62F55E
SHA1:	9E943DD18079AB5FEA9B3C8FAE1DBD8F2CB5340E
SHA-256:	99A62667B55C903DCC7CEA7C63C91032B739A58B8F614935DF24FF21DB3CC707
SHA-512:	484EDCAF6360FF60EF0EEA2F219EB2825972892552E7FEA6384EE33B0DD4CEDBFCD8B2830B874B6B9EF1E70FD5EB5F14C37E6042037DC786CE93C0737228760C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a225513d7b21485dbd40df56dc890e7c.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82354X9saR2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4165997497189
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4MnTeQ1yxvsjs2q:SbFuFyLVI6g7/+BG+f+M4MnTVU0jNq
MD5:	54858EB4857F3499DC0A4D3817328567
SHA1:	F218C15B44DD585DC6327BD10DADA0687394E9E2
SHA-256:	15F9084545609F82A903EC017770251103DC47AE8911BEB1D7E5E82D18E1FCD2
SHA-512:	CA55260DE42DE0F995FF6CA8CF441292246D561994D879C925AE1E974BAE2698E5F14059325DCF8F59491B1D1B2F8F7E971A1AD5A1FB4E17954B5C266ADC07CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2977d1e325d9421689d2dc2e5157b042.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82404nWRvV4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.549030470832714
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8kG7OjvZjFQMzKaBu:qgFqo6g7/+0+f+M82Tmh
MD5:	A51FBB7A661B4D579AF24377CCB9BD7C
SHA1:	34D48DA6A870A1E319B6B4FD21D0A3B29CF478F7
SHA-256:	E3A8B77DABDC7BD8F9F4983EA31F395AC9EEA098B36B9F55844F097D8BB70E08
SHA-512:	40089B8CAE1102B70134EF46C1897934C429D567813BE9766E7FCCD2203AF58137EB53836787FA195A41B80EF765A9F987C77323ED5CBE0574740A36CE8207D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6728539cc5394eb990f69802a7755512.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:82406QbYZ03

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.479354592519622
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MAoWTV0jFQMzKaBu:qgFqdg7/+0+f+MXWT0Tmh
MD5:	79A2409F0F1C3BD951663A90A8F64678
SHA1:	B3575F66BB1E88291B855114050F32523D5D9D68
SHA-256:	EC3D20C50F416F395B0F243F44666D0C6052DB593126E28147A81D08605D891A
SHA-512:	F802668E4BB5EF67789D9B3551757448D006779FFA70B06AF6447DC5CEE7D6BE71E353EAFA44B6D11734FF8C710ED10EC567EC78497117AC8D3AB39E5F72E048
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb45d843d77343d4af436c8d7ce98840.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:83911uSCAtK

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.402590519381159
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7tmgX7JL0js2BD0:SbFuFyLVK6g7/+BG+f+MvX7JL0jNq
MD5:	B85165B37252FFE6EADFEA25AB0BAFE9
SHA1:	98BA9EEF7CE9D892F61918E1DAB230D52521E7B2
SHA-256:	A8487D38D408CAFD54836900D301E134DD9ECED007434D619126C61E695CBA7C
SHA-512:	D42E8FAC1DF0D1A6C9372C5A359C68672800D8A1041A918E4C855A94B679F1D048ABD9CE8C587873844FB061A258DF012F99F4A9EF00A531A12A5BA7CD98103D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=10b7ed51cde34ca983e08d82737a7287.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:83913nFjjtL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.346517020272203
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzPSEryQt/EGmfA1:SbFuFyLVI6g7/+BG+f+MWErp6uejNq
MD5:	13454A2B424B93C10244E88605869717
SHA1:	60AA8D0A4872B65058CDE8B3EFA4044C11919141
SHA-256:	3F3385F8E2BEB0DCFCB1AAADEDDE8AFB6938475784354D3E1CF9887F375E87B7
SHA-512:	1D93827D6AC8EEA9FE3C642757DF2EE03054A55C9C132F097044F2FB93506572F8F3ADD961CDAFD9AAB2AC2D508DEBBB210DACFE9A851E586CA4F71F96C44E3B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9aa207ad8da041aa8208cc4e1cf9a618.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:83981NXdjqO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.435802057836258
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MSmANLx3+vsZjLTTIWTIL:qgFq6g10+f+MtuBEWEL
MD5:	F6F50932AF28514C7D7D9DF54B299911
SHA1:	D242024FFB1C8F9BF7BCD74378B647225A5AF32D
SHA-256:	B60DD295256AEB5D4EFDEA9551930047C568E67F04167CABEA1D34C78C76C474
SHA-512:	E7A2F8A6A3CD183DF5914451A3B958B1C9F8707AAEBDC1F2264A023542ED481DE2B3F09AE0E525CB4B923FC6C743612DBEAD02ABC807A66CE82E290E1047B1CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5a69d6e6de03488c9b42b760a244f02e.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:85072UWLN9K

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4142326674603085
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyAyX0EAC/sZjZcHBrt:qgFq6g10+f+Mo0pC/szmBB
MD5:	D97ECE58940A79036DE5366342BE8FE7
SHA1:	A516A4D1751E8DA19817ABE57630502F9BE4A43B
SHA-256:	210B8C44C54819B911B035E940EF3C4339C763CABE3D9972CE324A844DD06AF3
SHA-512:	053C1EE2A61E5A98C014AF16A770956B5D13BA86B26218CD3F31F6B6743A0D70EDA79B201660D668053F395336BE68007F29163F38B57454312D787674D6CE39
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8ccc7502789a41a49ba47f54eacb3ac2.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:85087SGRLvN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.564958937346745
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MssGJxbjFQMzKaBu:qgFqo6g7/+0+f+MsTlTmh
MD5:	DE805DC3B6CAFABF21341BBF360A2B3F
SHA1:	F5246F6A79F09C8D5B986AFB1A645C38E4774E0B
SHA-256:	444003C8F5517994FC90AD63CC024159E90FF228C75FA30D61E9FC71FF3D6713
SHA-512:	939B10D9F7AB0A3A250B6E0FDBA07578EB2F1C55F43513BAA183756C6AF4BADD9E86572788BBD9B282E52FF43C627BB43831AC94F6F1B7FC8127E9B6D7035EAD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f98c5b398747437681da225d1625bf30.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:85089xmRNCL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.475849206288664
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Ms1m0liHt0ZjFQMzKaBu:qgFqdg7/+0+f+MsbUN0vTmh
MD5:	BEC66ADF083B50E6157FAB5C332949B9
SHA1:	2B61E446EAEDC2F4B786A7A784375970755A974C
SHA-256:	DA85B05E5527E2D124374D6BB5E8AAD128D9F968DB6283613929610BB1A97F4D
SHA-512:	F8CDFD35816C577214E4B1C259D996ED8ABB5901AD1D7F695CFADBA232B18D461805FA9DA00CE28458F41B09FE6749255B701BAA362C27FB0D36FA00FB8478BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fa4cd9bbf2fe407eb4d947a2b193e37b.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:85235FJJNjN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.380437088659194
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+Y/TH24WdxlK8jsiI:SbFuFyLVIg1BG+f+M+STH24GlK8jZcHT
MD5:	2A0CBD3F202ABD9AFFCD53B3036A6E4D
SHA1:	9AF1E2B7BAFE7F97016F1BA230CDB1658EFD90EF
SHA-256:	8FABF16EA660AABD13816B7149BDDC2F216E954F678E94F187DEC1EAE03F526D
SHA-512:	73A25419A11FC2077BF53181F86ECF65F6ED39C15F462244B21A4FEB629E518537967C85F1887F60DDF3F0EAE377692861D86AA6B13F256F8ED5ABC442B31F78
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4e80f756b9b4497f8e0c2fe3843a91f9.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:852833G71yM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.368802694871792
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzrGxGRvXZqn22jshQ:SbFuFyLVIg1BG+f+M0y2jtWL0
MD5:	EE46C03A90FF53A5ADA9CACC49B7F9A6
SHA1:	72E3F7647F1DEA2D43BC7C7831DB1E321CA6B31C
SHA-256:	FF2EF5B77131033A838F82A466C4FF9FD493824877E385084B8851B5823AFF4D
SHA-512:	EA7E18B41D522597B48166BCD091273F7855609CD0B2128B975E46382F777CCAE2512AEB276B6A5EDBB2DC5C94B7FF432AB8B95EE8B624D9F71ED94D5961B710
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9af5cddd950c46e692609c3854bb31b6.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:85409VqsZSO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.360269355557921
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9aCHUVG0/cHqsh+s9:SbFuFyLVIg1BG+f+MQCHUVrATjoa
MD5:	B471ADC7FF02819DAADC0871C1068D94
SHA1:	611581CCFCC059BDE8F812C2C74EDDC184129D54
SHA-256:	B7C9B1387C1B0814ACC9B23149608576B38FCEAF9BF64D537BE198558522BA7D
SHA-512:	A17D8A432A1128A6FE20846482A8F8F3BB24DC8E9D4263A886C58C9A9E58393A12D935D6F93C98279993D1C2CAF40372E1FCD0EEFE7E1D80A8E76769B8469EB6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7fca30edb10c4f4fb97c13356fb9bccc.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat0C2PpDV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0IseuKv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Qt5NW6

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0USZbxF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0mO91HH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0ru4DCX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0uyOIB3

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#127HQAwgG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.491968736980953
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff80CgPRfQzk5t6st6n:qgFq30dABibBE0CgPcoIo6n
MD5:	61F3DC732C97B6036756288B036DCE6E
SHA1:	CB02099A324493E9199610F22F4C4D6394B00C8A
SHA-256:	F7C51AC6F8F833507F48B7013ABD78260A62F6BCB6D52E62CCF5E6E0F7CB0081
SHA-512:	7A2E93B172A55CB7A8620D23829840E6520857E67FA68A2E2429B529DD041261294A1FC0CB3E7B5F5ECD3A699F5247158947A86C83F20A8086E55F5F59B94FF0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14129.REALTIME=1733085030460681.MONOTONIC=515763779.LAST_SESSION_TIMESTAMP=515839569.

/run/systemd/users/.#127KPt9WD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.327705066863693
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgG3Q8Vfyf92QgVZkWi206qodq0:SbFuFyL3BVgdL87iesnAiRJgPRfQzk5s
MD5:	982006DC651034E1F23DC2F8FCB44BFC
SHA1:	D3C5D6D948277C1819EA11FC2FF36173EC94E75F
SHA-256:	21B9BE1B0CE2E7F8A034FA410A005DE93A043DEE8AC9C5C6C849BA367793835F
SHA-512:	72834BD7526F222E0969D531FD450B5FBDAAFA223FB6653DD0933DF577DF561AFFA6749F9807536C4663D9BEE4F59861735868CA11555C7D80ADB1875688BC19
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733085030460681.MONOTONIC=515763779.LAST_SESSION_TIMESTAMP=515839569.

/run/systemd/users/.#127KtrI9W

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.31772819247704
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBgwwDG/2Q2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgwwDw2jthQHtPYqi
MD5:	B52C1DABAD64407AE987A571A39C3D20
SHA1:	DFFBCED7908EA3A1FF159708FC28F2066AA688C8
SHA-256:	E9F0535DC44ADDA4EA0C1E165E8CAE45C52F3DBFE075763051B6314E6DAB9D3B
SHA-512:	370B2496C2E995A6E9EC0901E9802F060A68B2CF875C54E7BF70FA19236F4C4B3FC955454F207DDDFE97C5275124955612DCDAB6AA1214A5BCCB465D2514B604
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1733084992933569.MONOTONIC=478236666.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127VVTWr6

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127W7A9dX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.31735869295691
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgG3RccwD5A/pk2g206qodGo:SbFuFyL3BVgdL87iesnAiRJgwwDG/K52
MD5:	D4C143D78287348D4ED405B1BB942DDE
SHA1:	E1BD879172D816ACA695C4050C7A77B4CE78DD2C
SHA-256:	60BACCE9BD3BBCF4D15F4AD3084890CE6EB840FA9C9D2081042BB8C189374096
SHA-512:	CACEC02FDFCB964B5D770472F69732C376B8C0B0F15641BFB49D0E8877A52DAE0121076D350785EBFF7145A9229E11C3938D72A01D34E251A144EF830818F3A3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733084992933569.MONOTONIC=478236666.LAST_SESSION_TIMESTAMP=478329976.

/run/systemd/users/.#127WJIz84

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.277963560932351
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgG3Q3ywQK4wUtdcd9H206qodsX:SbFuFyL3BVgdL87iesnAiRJgP3ywX4eB
MD5:	A8F29926D95C14E56A86C407DC17884A
SHA1:	E0C489A2E73C8C933A161278AA330E453F87B83D
SHA-256:	4014FA949BA77286FAB3CEDDCA991DE6FFB9460F413C9897FF73329983DFB5DE
SHA-512:	3BC80344DF81241C49EDBC3E54CD02D43A763D4FAABD289516EECD6D0D1C84D706E98EBD8B5833BE1D1F0A23CF746E3E73C96A4BF6D48B387489C0A8C3B465C7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733085085889795.MONOTONIC=571192893.LAST_SESSION_TIMESTAMP=571312373.

/run/systemd/users/.#127XHwvRX

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127eFPeyH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.298098382004381
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8+JgPRfQz4Q2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE+JgPc4jthQHtPYqi
MD5:	3FEDF719E11A2DF73EDFF4B13E8AC63D
SHA1:	04F07059E55D165B7FC802021CF718FB142AAC1D
SHA-256:	4C17409AF043945EAE6A67C0A8E1E730030E4B545099BB282DEBC057CA45DAAE
SHA-512:	214142130121CAAA71D229376ACF57329AA0114D1447983B4C7846B8852448A0194B19DC85B22E985C3E36914DD5A0384C055289747A4DECC8430C064770B372
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14067.REALTIME=1733085030460681.MONOTONIC=515763779.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127hThOk5

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302307924584854
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8kJgP3ywX4eDQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEygPBJ3thQHtPYq9M
MD5:	98568B5BCF25693258F0C15B9977C725
SHA1:	04198991CF56763B728BDDDD434D906017F54849
SHA-256:	E32515F79D3D447FE13D683C6306D43861CCB2F4F21669621D21C985CBC9B3CC
SHA-512:	385048C1CB8621B5D727A47BE6BC1FD45BC6AFEF7731C2C65D50CCC26D89168A16D8B90A04A0A45E80130ABC8AF56B24B3716062E6738616D518C3839ECA21C8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14744.REALTIME=1733085085889795.MONOTONIC=571192893.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nKAyJU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.31772819247704
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBgwwDG/2Q2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgwwDw2jthQHtPYqi
MD5:	B52C1DABAD64407AE987A571A39C3D20
SHA1:	DFFBCED7908EA3A1FF159708FC28F2066AA688C8
SHA-256:	E9F0535DC44ADDA4EA0C1E165E8CAE45C52F3DBFE075763051B6314E6DAB9D3B
SHA-512:	370B2496C2E995A6E9EC0901E9802F060A68B2CF875C54E7BF70FA19236F4C4B3FC955454F207DDDFE97C5275124955612DCDAB6AA1214A5BCCB465D2514B604
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1733084992933569.MONOTONIC=478236666.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127obJ2k6

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302307924584854
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8kJgP3ywX4eDQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEygPBJ3thQHtPYq9M
MD5:	98568B5BCF25693258F0C15B9977C725
SHA1:	04198991CF56763B728BDDDD434D906017F54849
SHA-256:	E32515F79D3D447FE13D683C6306D43861CCB2F4F21669621D21C985CBC9B3CC
SHA-512:	385048C1CB8621B5D727A47BE6BC1FD45BC6AFEF7731C2C65D50CCC26D89168A16D8B90A04A0A45E80130ABC8AF56B24B3716062E6738616D518C3839ECA21C8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14744.REALTIME=1733085085889795.MONOTONIC=571192893.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127oiDY74

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473292517086869
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff81JgP3ywX4ent6qP5lv:qgFq30dABibBEfgPBJnIqPXv
MD5:	094D21ECD4DE87D9EA06DC2EC3C853F3
SHA1:	A8CB1323E40D2D2C640724CC8F78651DD0FE921D
SHA-256:	F93487224A8DEA1CC7207388EEA54A52E0592D9E7A3AB6E3D09B8EBEDC3E4093
SHA-512:	EE35FFE2C58EB88D0F04BB47D890938F825B05C4B01751B1730A7CCB4B26096D9580186A8588F0E5F897F78D8DC5F242BCE462A072686388CA2A83F8A6638D83
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14806.REALTIME=1733085085889795.MONOTONIC=571192893.LAST_SESSION_TIMESTAMP=571312373.

/run/systemd/users/.#127xyZcNG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127xzYLu6

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473292517086869
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff81JgP3ywX4ent6qP5lv:qgFq30dABibBEfgPBJnIqPXv
MD5:	094D21ECD4DE87D9EA06DC2EC3C853F3
SHA1:	A8CB1323E40D2D2C640724CC8F78651DD0FE921D
SHA-256:	F93487224A8DEA1CC7207388EEA54A52E0592D9E7A3AB6E3D09B8EBEDC3E4093
SHA-512:	EE35FFE2C58EB88D0F04BB47D890938F825B05C4B01751B1730A7CCB4B26096D9580186A8588F0E5F897F78D8DC5F242BCE462A072686388CA2A83F8A6638D83
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14806.REALTIME=1733085085889795.MONOTONIC=571192893.LAST_SESSION_TIMESTAMP=571312373.

/run/systemd/users/.#127yhev9G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.298098382004381
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8+JgPRfQz4Q2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE+JgPc4jthQHtPYqi
MD5:	3FEDF719E11A2DF73EDFF4B13E8AC63D
SHA1:	04F07059E55D165B7FC802021CF718FB142AAC1D
SHA-256:	4C17409AF043945EAE6A67C0A8E1E730030E4B545099BB282DEBC057CA45DAAE
SHA-512:	214142130121CAAA71D229376ACF57329AA0114D1447983B4C7846B8852448A0194B19DC85B22E985C3E36914DD5A0384C055289747A4DECC8430C064770B372
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14067.REALTIME=1733085030460681.MONOTONIC=515763779.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mQTv:mQj
MD5:	28B6A496E9EC2A992A16A1E61D059BB0
SHA1:	8A5370C907D344422A871BAB2F51CEE2FE156D83
SHA-256:	9E4C26E07528688600961F7645B5BD109F7B2BF5DB5FD1E5AEBEE1358E0D425F
SHA-512:	9817B2794C5D87DD2A15F49B19F4E0A18C27CD94B50081F073BB48610A9EEED1FE8F73A247B7713F4A0F19BE3353F63EC6BBA04172BEA9E96823C2C739603D8F
Malicious:	false
Preview:	7056.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nun:un
MD5:	F285506BFE4DCDE524264DEDECD4E3A1
SHA1:	988D9CB1F6A8631081EF4DFAF3EA5E0E4DB17D4F
SHA-256:	4D248B9A78E1CF3EAFC837E1D1D3926D2B1CD398F451173F13857588788E689B
SHA-512:	F432FF87B9512D6CE6ABDBB057334C632B5355D07FB2F2684FDD4D5E7EEC52EFAE043C93B25289300961BDDA62EB427CAD8E7C69E46E04E3BD05C6350A64F695
Malicious:	false
Preview:	7110.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6615094784089013
Encrypted:	false
SSDEEP:	3:xCsXlXEWtl/flXCC:xf+ylHl
MD5:	E347BB45804680F018441C40B704B077
SHA1:	5CAA3E40FA0BE524E772D63A49000F71E3508DA1
SHA-256:	164C1F3BAF3E2B3517CE529BCD03031FFAAE9C06738AD115BFBD2BE0942E35A9
SHA-512:	ED05880A03AF56EAA947442E8BE8F3AD3ED3F3B99A66807298E8FAC0C108154C552E9CB92745C83F6C337AD4BFDF735D48E322A241E228FF16EAB42BA57CC83D
Malicious:	false
Preview:	....5...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................5.....Lgt.......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nXn:X
MD5:	B50062474DE644849FFFD35B154DD1D5
SHA1:	440E5E307FDD02A631727163929E44E279BF49CF
SHA-256:	8562DB7F9631EC4394DBFACAC8FEF9B8BD4F6079ACFE4E371785AFFC5C8BCCE9
SHA-512:	7FA2D75591F6915101F72F38191ACF24EB3DDB4DC8590C691C848E12E11B1A58F73D2B19865FF94777D0A15061BFA376BD050C4B6231E81C55749B9DD379D35B
Malicious:	false
Preview:	7113.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n2v:I
MD5:	62055046EDD9CB4EB8FBF386F1B8C17A
SHA1:	6F375AA4369710075485240201FC2FE3575596C8
SHA-256:	6C623B817CB2FEC068AC487627DACAE5AD07A248974A61EA64AB5C06E3E013E4
SHA-512:	3D62428D12B92A5EE0B75B8C1DDB44A2C53E136C1C9C81186A55F7D766E5AA8DE1CAFA3E8E955A3BEA3155CF8FFC2EA8F2E22B4908E51032674AC89AB3C71786
Malicious:	false
Preview:	7109.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:mcXKp:mcap
MD5:	1028A17BFDB12A7CA4BBE25DF2C10D46
SHA1:	EE5E8ED8C5822AB35DFB6C6EB47A96BDCEB4225D
SHA-256:	E95DF44321EF1E86C4C8CF2EEDEE0C938F29FCB056D87A89A1551D3EED2842E1
SHA-512:	DE71CB9B3F0D96C685E9FBA121A9F70C9EDE0FC8C71277AAC0458143C6B4867358B3775F244DD8989813A8F2BE2AE21DDB05C1BB702F54E587AA7D39760DE487
Malicious:	false
Preview:	7092.7093.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nun:un
MD5:	F285506BFE4DCDE524264DEDECD4E3A1
SHA1:	988D9CB1F6A8631081EF4DFAF3EA5E0E4DB17D4F
SHA-256:	4D248B9A78E1CF3EAFC837E1D1D3926D2B1CD398F451173F13857588788E689B
SHA-512:	F432FF87B9512D6CE6ABDBB057334C632B5355D07FB2F2684FDD4D5E7EEC52EFAE043C93B25289300961BDDA62EB427CAD8E7C69E46E04E3BD05C6350A64F695
Malicious:	false
Preview:	7110.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nXn:X
MD5:	B50062474DE644849FFFD35B154DD1D5
SHA1:	440E5E307FDD02A631727163929E44E279BF49CF
SHA-256:	8562DB7F9631EC4394DBFACAC8FEF9B8BD4F6079ACFE4E371785AFFC5C8BCCE9
SHA-512:	7FA2D75591F6915101F72F38191ACF24EB3DDB4DC8590C691C848E12E11B1A58F73D2B19865FF94777D0A15061BFA376BD050C4B6231E81C55749B9DD379D35B
Malicious:	false
Preview:	7113.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n2v:I
MD5:	62055046EDD9CB4EB8FBF386F1B8C17A
SHA1:	6F375AA4369710075485240201FC2FE3575596C8
SHA-256:	6C623B817CB2FEC068AC487627DACAE5AD07A248974A61EA64AB5C06E3E013E4
SHA-512:	3D62428D12B92A5EE0B75B8C1DDB44A2C53E136C1C9C81186A55F7D766E5AA8DE1CAFA3E8E955A3BEA3155CF8FFC2EA8F2E22B4908E51032674AC89AB3C71786
Malicious:	false
Preview:	7109.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:mcXKp:mcap
MD5:	1028A17BFDB12A7CA4BBE25DF2C10D46
SHA1:	EE5E8ED8C5822AB35DFB6C6EB47A96BDCEB4225D
SHA-256:	E95DF44321EF1E86C4C8CF2EEDEE0C938F29FCB056D87A89A1551D3EED2842E1
SHA-512:	DE71CB9B3F0D96C685E9FBA121A9F70C9EDE0FC8C71277AAC0458143C6B4867358B3775F244DD8989813A8F2BE2AE21DDB05C1BB702F54E587AA7D39760DE487
Malicious:	false
Preview:	7092.7093.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nun:un
MD5:	F285506BFE4DCDE524264DEDECD4E3A1
SHA1:	988D9CB1F6A8631081EF4DFAF3EA5E0E4DB17D4F
SHA-256:	4D248B9A78E1CF3EAFC837E1D1D3926D2B1CD398F451173F13857588788E689B
SHA-512:	F432FF87B9512D6CE6ABDBB057334C632B5355D07FB2F2684FDD4D5E7EEC52EFAE043C93B25289300961BDDA62EB427CAD8E7C69E46E04E3BD05C6350A64F695
Malicious:	false
Preview:	7110.

/var/lib/AccountsService/users/gdm.PEBSX2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.QHQ6X2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.X5DTX2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.89495073810423
Encrypted:	false
SSDEEP:	24:I8fJZeas8f3Gs8fLc8fgnL8f8Avk8f8A2+VW8f/LfJ0pYrtJrNW8rCQU:I8fi8f/8fo8fgL8fRvk8fRfVW8fDf8Ys
MD5:	1C1A07A3010F21AC9CCD091B72BACE57
SHA1:	DC01D9FB463A221D66E9E03574CF0F94FEF00A9A
SHA-256:	6B77285F946FF05C3E3EC2B0E2A1522935C5797863701E65559AE96EAEE28C2F
SHA-512:	C3E46F8C5E496A9B838BF05A980B269E8AB5D5473C5C1C23ADB501B84484E90C48B1CFB7C8E205DA3F96ADBA1B9627848F154B55C6AEDE5FA17E4BCACC81E0A2
Malicious:	false
Preview:	Dec 1 14:31:12 galassia systemd-logind[6968]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 1 14:31:12 galassia systemd-logind[6968]: User enumeration failed: Invalid argument.Dec 1 14:31:12 galassia systemd-logind[6968]: User of session 2 not known..Dec 1 14:31:12 galassia systemd-logind[6968]: Session enumeration failed: No such file or directory.Dec 1 14:31:12 galassia systemd-logind[6968]: Watching system buttons on /dev/input/event0 (Power Button).Dec 1 14:31:12 galassia systemd-logind[6968]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 1 14:31:12 galassia systemd-logind[6968]: New seat seat0..Dec 1 14:31:25 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 1 14:31:25 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 1 14:31:26 galassia systemd-logind[6968]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlAo4EtlQo4EVlX:F3wYQo
MD5:	1F03E838CAB346A21B3CE1C7B57F3242
SHA1:	72CBF527564D0A233E8E8A2E6E7BBF99F9F89C5D
SHA-256:	16541A49E05A9E38B08460148B52F72D89D16AC4B0FA7187CBE14E5A09156673
SHA-512:	31C5DE86E06F19B9F63BB82A58DB61585362971DA1AAC2D70DD8882EC13933C83D11B3E60FDDEC3DF7CCB19C440FC3933019A5B1C547BC1E36110A1B95CCC9EB
Malicious:	false
Preview:	LPKSHHRH.....................oM...;.D..$.....................................oM...;.D..$........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlYPuAy4PuAyVlt:F3tx9xVl
MD5:	5B10088BAB00AB59D3233B297E8CA681
SHA1:	B7E17DC291C4F108DFCB13E47B037982CD804EB9
SHA-256:	1A5DA908ACE080CE5D6E5F2A1EA5603C984BB48307326941C9F53053817C6605
SHA-512:	8424260868021053CADD122779348088F88F398FE47935FDBF00B8099BB34EA93F67ECF87D640D60DB55C203F48E77C6070E8D08A8AEB7A337CCDE50BD2990B9
Malicious:	false
Preview:	LPKSHHRH.................<..k.G......7WD.................................<..k.G......7WD........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12311
Entropy (8bit):	4.934379638599145
Encrypted:	false
SSDEEP:	96:NJZ/lCFr1Rhtes5vwmKCTGOlc7kzW+ZueuljRjXxY9UTfiYlmw5yAr0ZRA66Ld2S:B/sBlxAr8JJM8ONnJiy/drA0S+
MD5:	5E9193FB8310F9756BD38FCC4FF1433D
SHA1:	A745C18F01CE79A39CEE0B0A29428F45B0F3BE3D
SHA-256:	2FA48D26F9995CBBD9E2EC6AEC7790D35F48BB1C67890CAC33AF49B6B5243B94
SHA-512:	D7A1F9233EE160566E7C8CC10D891ABCEC3DD02FC64CE8EB09971AB217FDBF6599CEA9CE7B2E8157949A55A75EFFFE53DC273FB6121D519AEB6BFBA734B07C8B
Malicious:	false
Preview:	Dec 1 14:31:06 galassia kernel: [ 550.864223] blocking signal 9: 6237 -> 658.Dec 1 14:31:06 galassia kernel: [ 550.864682] blocking signal 9: 6237 -> 720.Dec 1 14:31:06 galassia kernel: [ 550.869450] blocking signal 9: 6237 -> 772.Dec 1 14:31:06 galassia kernel: [ 550.870584] blocking signal 9: 6237 -> 936.Dec 1 14:31:06 galassia kernel: [ 550.871035] blocking signal 9: 6237 -> 2048.Dec 1 14:31:06 galassia kernel: [ 551.466148] New task spawned: old: (tgid 7025, tid 7025), new (tgid: 7025, tid: 7028).Dec 1 14:31:06 galassia kernel: [ 551.466251] New task spawned: old: (tgid 7025, tid 7025), new (tgid: 7025, tid: 7029).Dec 1 14:31:06 galassia kernel: [ 551.474867] New task spawned: old: (tgid 7025, tid 7029), new (tgid: 7025, tid: 7030).Dec 1 14:31:06 galassia kernel: [ 551.680271] New task spawned: old: (tgid 7026, tid 7026), new (tgid: 7026, tid: 7031).Dec 1 14:31:06 galassia kernel: [ 552.015631] New task spawned: old: (tgid 7032, tid 7032), new (tgid: 7033, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	31704
Entropy (8bit):	5.075897099411865
Encrypted:	false
SSDEEP:	768:TFKrKuUvnKt00bfFNAke0CmYxv59jjZ8dUo1JrtOSQSkwOJfL1FXjxeMYKr:MQDTfZRf
MD5:	99014AA05358865FE8E91976FD0BBAF5
SHA1:	78394D72AF2704F1DA6779002AF164EE3A5F2A92
SHA-256:	5D98529303503D979B81649F1669395D613D969E73E05B0F0AA579ECB062C188
SHA-512:	BA9FD7BA82A4ABDB95A0855B3A2419237E02AAC917449102DA139FB2EA88E7D398B6379EE5AD0950FA6F9733C9A303F9A6E0BCAA99B0EC0637E82B10DB374A04
Malicious:	false
Preview:	Dec 1 14:31:06 galassia kernel: [ 550.848566] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 1 14:31:06 galassia kernel: [ 550.848652] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 1 14:31:06 galassia kernel: [ 550.849254] systemd[1]: getty@tty2.service: Succeeded..Dec 1 14:31:06 galassia kernel: [ 550.849819] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 1 14:31:06 galassia kernel: [ 550.849881] systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 1 14:31:06 galassia kernel: [ 550.850491] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 6..Dec 1 14:31:06 galassia kernel: [ 550.850499] systemd[1]: Stopped Getty on tty2..Dec 1 14:31:06 galassia kernel: [ 550.851236] systemd[1]: Started Getty on tty2..Dec 1 14:31:06 galassia kernel: [ 550.864223] blocking signal 9: 6237 -> 658.Dec 1 14:31:06 galassia kernel: [ 550.864682] blocking signal 9: 6237

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6615094784089013
Encrypted:	false
SSDEEP:	3:xCsXlXEWtl/flXCC:xf+ylHl
MD5:	E347BB45804680F018441C40B704B077
SHA1:	5CAA3E40FA0BE524E772D63A49000F71E3508DA1
SHA-256:	164C1F3BAF3E2B3517CE529BCD03031FFAAE9C06738AD115BFBD2BE0942E35A9
SHA-512:	ED05880A03AF56EAA947442E8BE8F3AD3ED3F3B99A66807298E8FAC0C108154C552E9CB92745C83F6C337AD4BFDF735D48E322A241E228FF16EAB42BA57CC83D
Malicious:	true
Preview:	....5...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................5.....Lgt.......................................

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:52674 -> 178.215.238.4:33966

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.354444824666875
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	iwir64.elf
File size:	168'168 bytes
MD5:	7bbdc5c843c2d6a1dd44c4f8292ae3bd
SHA1:	e05dcf35d38fe69e8916cca7b010629e113f2d43
SHA256:	a00117a5ad41cfacac850edcdb707e66926e858a4368ce137d38ac7fdd5b932e
SHA512:	2d7ecda57bc3a718c3e5f87b821345f1fafe2bbf201df4205aca74ea015440b50069b86e265b4ea8b9753979f25fe2ccf2f0d5b9cdf95b79edeb1b46a755a8c5
SSDEEP:	3072:f2dSBfqWx37k9o6JjAxV3YbCwjTPmEqhg/VyOPmV3Rt9NMYVB7O+:f2gBfqWx37k9oKAxKpeVvVtO+
TLSH:	D2F34C06B5C188FDC4DAC1744B9EB53BAD31F19D1238B26B37D4AB272E8DE205B1DA50
File Content Preview:	.ELF..............>.......@.....@.......h...........@.8...@.......................@.......@...............................................R.......R.....(.......@...............Q.td....................................................H...._........H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	167528
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x1bab6	0x0	0x6	AX	16
.fini	PROGBITS	0x41bbb6	0x1bbb6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x41bbe0	0x1bbe0	0x3aa0	0x0	0x2	A	32
.ctors	PROGBITS	0x520000	0x20000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x520018	0x20018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x520040	0x20040	0x8de8	0x0	0x3	WA	32
.bss	NOBITS	0x528e40	0x28e28	0x7100	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x28e28	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1f680	0x1f680	6.3742	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x20000	0x520000	0x520000	0x8e28	0xff40	0.2373	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 1, 2024 21:28:47.413805008 CET	50753	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:47.808075905 CET	53	50753	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:47.809577942 CET	49909	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:48.052767038 CET	53	49909	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:49.603485107 CET	59913	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:50.005850077 CET	53	59913	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:50.007112980 CET	42399	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:50.253258944 CET	53	42399	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:51.742472887 CET	34134	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:51.880024910 CET	53	34134	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:51.880723953 CET	48990	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:52.270690918 CET	53	48990	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:53.660804033 CET	60727	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:53.795206070 CET	53	60727	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:53.795989037 CET	42253	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:53.930495024 CET	53	42253	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:55.316096067 CET	57626	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:55.452148914 CET	53	57626	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:55.453016043 CET	52029	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:55.588821888 CET	53	52029	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:57.021202087 CET	36076	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:57.156016111 CET	53	36076	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:57.156758070 CET	37704	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:57.291743994 CET	53	37704	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:58.778336048 CET	47372	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:58.912457943 CET	53	47372	8.8.8.8	192.168.2.23
Dec 1, 2024 21:28:58.913163900 CET	34627	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:28:59.048028946 CET	53	34627	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:00.479779959 CET	38032	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:00.610512972 CET	53	38032	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:00.611236095 CET	45977	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:00.745620012 CET	53	45977	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:02.179987907 CET	45863	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:02.315109968 CET	53	45863	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:02.315783978 CET	36933	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:02.451783895 CET	53	36933	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:03.871542931 CET	42327	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:04.005609035 CET	53	42327	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:04.006375074 CET	58519	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:04.140476942 CET	53	58519	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:05.618160963 CET	34405	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:05.760256052 CET	53	34405	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:05.761020899 CET	43122	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:05.903115988 CET	53	43122	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:07.382621050 CET	47618	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:07.520973921 CET	53	47618	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:07.521748066 CET	34745	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:07.767601013 CET	53	34745	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:09.209229946 CET	33842	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:09.335443020 CET	53	33842	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:09.336168051 CET	55271	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:09.702265978 CET	53	55271	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:11.089761019 CET	37045	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:11.216582060 CET	53	37045	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:11.217498064 CET	55668	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:11.352210045 CET	53	55668	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:12.796204090 CET	42318	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:13.052665949 CET	53	42318	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:13.054191113 CET	39494	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:13.176975965 CET	53	39494	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:14.611146927 CET	45163	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:14.745287895 CET	53	45163	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:14.746340036 CET	47459	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:14.880984068 CET	53	47459	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:35.547849894 CET	33741	53	192.168.2.23	1.1.1.1
Dec 1, 2024 21:29:35.547878027 CET	58500	53	192.168.2.23	1.1.1.1
Dec 1, 2024 21:29:35.687458038 CET	53	58500	1.1.1.1	192.168.2.23
Dec 1, 2024 21:29:35.773060083 CET	53	33741	1.1.1.1	192.168.2.23
Dec 1, 2024 21:29:36.200828075 CET	53862	53	192.168.2.23	1.1.1.1
Dec 1, 2024 21:29:36.342609882 CET	53	53862	1.1.1.1	192.168.2.23
Dec 1, 2024 21:29:52.409008026 CET	48962	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:52.543354034 CET	53	48962	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:52.544682980 CET	60088	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:52.682019949 CET	53	60088	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:54.165285110 CET	52679	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:54.300316095 CET	53	52679	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:54.305196047 CET	51023	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:54.439532995 CET	53	51023	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:55.876024008 CET	55234	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:56.010925055 CET	53	55234	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:56.014609098 CET	58235	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:56.137702942 CET	53	58235	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:57.577038050 CET	50811	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:57.711455107 CET	53	50811	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:57.715502977 CET	43324	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:57.752404928 CET	59793	53	192.168.2.23	1.1.1.1
Dec 1, 2024 21:29:57.850472927 CET	53	43324	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:57.890686989 CET	53	59793	1.1.1.1	192.168.2.23
Dec 1, 2024 21:29:59.242181063 CET	59308	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:59.377213955 CET	53	59308	8.8.8.8	192.168.2.23
Dec 1, 2024 21:29:59.379219055 CET	36453	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:29:59.513700008 CET	53	36453	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:00.948411942 CET	35831	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:01.082453966 CET	53	35831	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:01.083254099 CET	54581	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:01.217825890 CET	53	54581	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:02.606543064 CET	35429	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:02.742286921 CET	53	35429	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:02.743180037 CET	35776	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:02.879719019 CET	53	35776	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:04.360079050 CET	43772	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:04.495861053 CET	53	43772	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:04.496500015 CET	40641	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:04.634639978 CET	53	40641	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:06.096544027 CET	41739	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:06.231937885 CET	53	41739	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:06.233412981 CET	60411	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:06.360682964 CET	53	60411	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:07.806548119 CET	37337	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:07.943073988 CET	53	37337	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:07.944637060 CET	52217	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:08.078953981 CET	53	52217	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:09.510926962 CET	56608	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:09.645782948 CET	53	56608	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:09.647038937 CET	60789	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:09.784826994 CET	53	60789	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:11.221782923 CET	34573	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:11.346527100 CET	53	34573	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:11.352577925 CET	33252	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:11.488770962 CET	53	33252	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:12.762654066 CET	50378	53	192.168.2.23	1.1.1.1
Dec 1, 2024 21:30:12.902467012 CET	53	50378	1.1.1.1	192.168.2.23
Dec 1, 2024 21:30:12.973361015 CET	50267	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:13.108894110 CET	53	50267	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:13.112919092 CET	45149	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:13.243822098 CET	53	45149	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:14.680273056 CET	38543	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:14.822205067 CET	53	38543	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:14.825762987 CET	46392	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:19.831041098 CET	40927	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:19.955562115 CET	53	40927	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:21.388998985 CET	40599	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:21.530838966 CET	53	40599	8.8.8.8	192.168.2.23
Dec 1, 2024 21:30:21.531742096 CET	41263	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:30:21.662139893 CET	53	41263	8.8.8.8	192.168.2.23
Dec 1, 2024 21:31:08.310894012 CET	49816	53	192.168.2.23	1.1.1.1
Dec 1, 2024 21:31:08.310894012 CET	53386	53	192.168.2.23	1.1.1.1
Dec 1, 2024 21:31:08.458416939 CET	53	53386	1.1.1.1	192.168.2.23
Dec 1, 2024 21:31:08.574305058 CET	53	49816	1.1.1.1	192.168.2.23
Dec 1, 2024 21:31:52.470067978 CET	39512	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:31:52.604372978 CET	53	39512	8.8.8.8	192.168.2.23
Dec 1, 2024 21:31:52.606021881 CET	34601	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:31:52.729063988 CET	53	34601	8.8.8.8	192.168.2.23
Dec 1, 2024 21:31:54.124989033 CET	52590	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:31:54.259152889 CET	53	52590	8.8.8.8	192.168.2.23
Dec 1, 2024 21:31:54.260554075 CET	58852	53	192.168.2.23	8.8.8.8
Dec 1, 2024 21:31:54.384196043 CET	53	58852	8.8.8.8	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 1, 2024 21:29:37.556502104 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 1, 2024 21:30:57.566333055 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-01 20:29:40 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-01 20:29:41 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-01 20:29:41 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-01 20:29:42 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sun, 01 Dec 2024 20:29:41 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	20:28:47
Start date (UTC):	01/12/2024
Path:	/tmp/iwir64.elf
Arguments:	/tmp/iwir64.elf
File size:	168168 bytes
MD5 hash:	7bbdc5c843c2d6a1dd44c4f8292ae3bd

Start time (UTC):	20:28:48
Start date (UTC):	01/12/2024
Path:	/tmp/iwir64.elf
Arguments:	-
File size:	168168 bytes
MD5 hash:	7bbdc5c843c2d6a1dd44c4f8292ae3bd

Start time (UTC):	20:30:12
Start date (UTC):	01/12/2024
Path:	/tmp/iwir64.elf
Arguments:	-
File size:	168168 bytes
MD5 hash:	7bbdc5c843c2d6a1dd44c4f8292ae3bd

Start time (UTC):	20:30:13
Start date (UTC):	01/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:29:28
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:30
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:33
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:34
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:35
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:37
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:38
Start date (UTC):	01/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:29:39
Start date (UTC):	01/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report iwir64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6633/oom_score_adj

/proc/6945/oom_score_adj

/proc/7102/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:76029uT8Mrr

/run/systemd/journal/streams/.#9:76030fNxXPq

/run/systemd/journal/streams/.#9:761612vleOo

/run/systemd/journal/streams/.#9:76169JNjlUq

/run/systemd/journal/streams/.#9:76189GxRueq

/run/systemd/journal/streams/.#9:76333nCRHxq

/run/systemd/journal/streams/.#9:76336wpc1Xr

/run/systemd/journal/streams/.#9:76455Fh5JFp

/run/systemd/journal/streams/.#9:76493pUlxSr

/run/systemd/journal/streams/.#9:76614TLXXhs

/run/systemd/journal/streams/.#9:76695hNagws

/run/systemd/journal/streams/.#9:77930yAmLfs

/run/systemd/journal/streams/.#9:78014U4Q8Pp

/run/systemd/journal/streams/.#9:78036qCik5s

/run/systemd/journal/streams/.#9:78057dwzPNp

/run/systemd/journal/streams/.#9:78058VDXx1o

/run/systemd/journal/streams/.#9:78082XCn85s

Linux Analysis Report
iwir64.elf

Start time (UTC):	20:29:40
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:50
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:51
Start date (UTC):	01/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:29:53
Start date (UTC):	01/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	20:29:54
Start date (UTC):	01/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:29:55
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:56
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:29:57
Start date (UTC):	01/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:29:58
Start date (UTC):	01/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:29:59
Start date (UTC):	01/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75