Edit tour

Linux Analysis Report
dwhdbg.elf

Overview

General Information

Sample name:	dwhdbg.elf
Analysis ID:	1568625
MD5:	9d9b06ad1c145757a00b353a4efc8e26
SHA1:	1d8d16d5c3c7a81673a0cf9e554a56a0b9d46fc2
SHA256:	13dd4fa6a557a32c7c47553c50bb84427747ae3d2844ff29b9de98ad3aa80ec0
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1568625
Start date and time:	2024-12-04 20:03:27 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	dwhdbg.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/163@19/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: dwhdbg.elf

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6245, Parent: 4331)

rm (PID: 6245, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Xzkzx4hmrD /tmp/tmp.CJEPg7VdSm /tmp/tmp.xG4NGhTGYp

dash New Fork (PID: 6246, Parent: 4331)

rm (PID: 6246, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.Xzkzx4hmrD /tmp/tmp.CJEPg7VdSm /tmp/tmp.xG4NGhTGYp

dwhdbg.elf (PID: 6270, Parent: 6172, MD5: 9d9b06ad1c145757a00b353a4efc8e26) Arguments: /tmp/dwhdbg.elf

dwhdbg.elf New Fork (PID: 6271, Parent: 6270)

dwhdbg.elf New Fork (PID: 6411, Parent: 6271)

sh (PID: 6411, Parent: 6271, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6412, Parent: 6411)

ps (PID: 6412, Parent: 6411, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

dwhdbg.elf New Fork (PID: 6905, Parent: 6271)

sh (PID: 6905, Parent: 6271, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6906, Parent: 6905)

ps (PID: 6906, Parent: 6905, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6272, Parent: 1477)

sh (PID: 6272, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6272, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6277, Parent: 1)

systemd-hostnamed (PID: 6277, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6408, Parent: 1320)

Default (PID: 6408, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6409, Parent: 1320)

Default (PID: 6409, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6466, Parent: 1)

journalctl (PID: 6466, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6481, Parent: 1)

systemd-journald (PID: 6481, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6487, Parent: 1)

journalctl (PID: 6487, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6492, Parent: 1)

dbus-daemon (PID: 6492, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6504, Parent: 1860)

pulseaudio (PID: 6504, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6506, Parent: 1)

rsyslogd (PID: 6506, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6513, Parent: 1)

rtkit-daemon (PID: 6513, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6516, Parent: 1)

systemd-logind (PID: 6516, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6578, Parent: 1)

polkitd (PID: 6578, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6582, Parent: 1)

agetty (PID: 6582, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6584, Parent: 1320)

Default (PID: 6584, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6585, Parent: 1)

gpu-manager (PID: 6585, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6586, Parent: 6585)

sh (PID: 6586, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6587, Parent: 6586)

grep (PID: 6587, Parent: 6586, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6588, Parent: 6585)

sh (PID: 6588, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6590, Parent: 6585)

sh (PID: 6590, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6591, Parent: 6590)

grep (PID: 6591, Parent: 6590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6593, Parent: 6585)

sh (PID: 6593, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6594, Parent: 6593)

grep (PID: 6594, Parent: 6593, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6595, Parent: 6585)

sh (PID: 6595, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

grep (PID: 6596, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6601, Parent: 6585)

sh (PID: 6601, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6602, Parent: 6601)

grep (PID: 6602, Parent: 6601, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6606, Parent: 6585)

sh (PID: 6606, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6607, Parent: 6606)

grep (PID: 6607, Parent: 6606, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6608, Parent: 6585)

sh (PID: 6608, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6609, Parent: 6608)

grep (PID: 6609, Parent: 6608, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gvfsd-fuse New Fork (PID: 6597, Parent: 2038)

fusermount (PID: 6597, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6610, Parent: 1)

generate-config (PID: 6610, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6611, Parent: 6610)

pkill (PID: 6611, Parent: 6610, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6612, Parent: 1)

gdm-wait-for-drm (PID: 6612, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6618, Parent: 1)

gdm3 (PID: 6618, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6622, Parent: 6618)

plymouth (PID: 6622, Parent: 6618, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6632, Parent: 6618)

gdm-session-worker (PID: 6632, Parent: 6618, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6638, Parent: 6632)

gdm-wayland-session (PID: 6638, Parent: 6632, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6640, Parent: 6638)

dbus-daemon (PID: 6640, Parent: 6638, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6642, Parent: 6640)

dbus-daemon New Fork (PID: 6643, Parent: 6642)

false (PID: 6643, Parent: 6642, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6644, Parent: 6638)

dbus-run-session (PID: 6644, Parent: 6638, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6645, Parent: 6644)

dbus-daemon (PID: 6645, Parent: 6644, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6646, Parent: 6618)

Default (PID: 6646, Parent: 6618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6647, Parent: 6618)

Default (PID: 6647, Parent: 6618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6623, Parent: 1)

accounts-daemon (PID: 6623, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6627, Parent: 6623)

language-validate (PID: 6627, Parent: 6623, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6628, Parent: 6627)

language-options (PID: 6628, Parent: 6627, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6629, Parent: 6628)

sh (PID: 6629, Parent: 6628, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6630, Parent: 6629)

locale (PID: 6630, Parent: 6629, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6631, Parent: 6629)

grep (PID: 6631, Parent: 6629, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6651, Parent: 1)

agetty (PID: 6651, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6652, Parent: 1)

rsyslogd (PID: 6652, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6654, Parent: 1)

dbus-daemon (PID: 6654, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6660, Parent: 1)

gpu-manager (PID: 6660, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6661, Parent: 6660)

sh (PID: 6661, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6662, Parent: 6661)

grep (PID: 6662, Parent: 6661, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6725, Parent: 6660)

sh (PID: 6725, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6726, Parent: 6725)

grep (PID: 6726, Parent: 6725, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6728, Parent: 6660)

sh (PID: 6728, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6729, Parent: 6728)

grep (PID: 6729, Parent: 6728, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6730, Parent: 6660)

sh (PID: 6730, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6731, Parent: 6730)

grep (PID: 6731, Parent: 6730, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6732, Parent: 6660)

sh (PID: 6732, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6733, Parent: 6732)

grep (PID: 6733, Parent: 6732, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6734, Parent: 6660)

sh (PID: 6734, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6735, Parent: 6734)

grep (PID: 6735, Parent: 6734, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6736, Parent: 6660)

sh (PID: 6736, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6737, Parent: 6736)

grep (PID: 6737, Parent: 6736, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6738, Parent: 6660)

sh (PID: 6738, Parent: 6660, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6739, Parent: 6738)

grep (PID: 6739, Parent: 6738, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6666, Parent: 1)

systemd-logind (PID: 6666, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6740, Parent: 1)

generate-config (PID: 6740, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6741, Parent: 6740)

pkill (PID: 6741, Parent: 6740, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6742, Parent: 1)

gdm-wait-for-drm (PID: 6742, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6746, Parent: 1)

rsyslogd (PID: 6746, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6747, Parent: 1)

dbus-daemon (PID: 6747, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6759, Parent: 1)

systemd-logind (PID: 6759, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6817, Parent: 1)

journalctl (PID: 6817, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6818, Parent: 1)

systemd-journald (PID: 6818, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6819, Parent: 1)

rsyslogd (PID: 6819, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6820, Parent: 1)

dbus-daemon (PID: 6820, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6821, Parent: 1)

agetty (PID: 6821, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6828, Parent: 1)

systemd-logind (PID: 6828, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6885, Parent: 1)

systemd-journald (PID: 6885, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6886, Parent: 1)

gpu-manager (PID: 6886, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6889, Parent: 6886)

sh (PID: 6889, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6890, Parent: 6889)

grep (PID: 6890, Parent: 6889, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6892, Parent: 6886)

sh (PID: 6892, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6894, Parent: 6892)

grep (PID: 6894, Parent: 6892, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6896, Parent: 6886)

sh (PID: 6896, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6897, Parent: 6896)

grep (PID: 6897, Parent: 6896, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6899, Parent: 6886)

sh (PID: 6899, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6900, Parent: 6899)

grep (PID: 6900, Parent: 6899, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6901, Parent: 6886)

sh (PID: 6901, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6902, Parent: 6901)

grep (PID: 6902, Parent: 6901, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6903, Parent: 6886)

sh (PID: 6903, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6904, Parent: 6903)

grep (PID: 6904, Parent: 6903, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6907, Parent: 6886)

sh (PID: 6907, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6908, Parent: 6907)

grep (PID: 6908, Parent: 6907, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6909, Parent: 6886)

sh (PID: 6909, Parent: 6886, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6910, Parent: 6909)

grep (PID: 6910, Parent: 6909, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6913, Parent: 1)

generate-config (PID: 6913, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6914, Parent: 6913)

pkill (PID: 6914, Parent: 6913, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6915, Parent: 1)

gdm-wait-for-drm (PID: 6915, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6922, Parent: 1)

gdm3 (PID: 6922, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6925, Parent: 6922)

plymouth (PID: 6925, Parent: 6922, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6939, Parent: 6922)

gdm-session-worker (PID: 6939, Parent: 6922, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6943, Parent: 6939)

gdm-wayland-session (PID: 6943, Parent: 6939, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6945, Parent: 6943)

dbus-daemon (PID: 6945, Parent: 6943, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6947, Parent: 6945)

dbus-daemon New Fork (PID: 6948, Parent: 6947)

false (PID: 6948, Parent: 6947, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6949, Parent: 6943)

dbus-run-session (PID: 6949, Parent: 6943, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6950, Parent: 6949)

dbus-daemon (PID: 6950, Parent: 6949, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6953, Parent: 6922)

Default (PID: 6953, Parent: 6922, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6954, Parent: 6922)

Default (PID: 6954, Parent: 6922, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6926, Parent: 1)

accounts-daemon (PID: 6926, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6930, Parent: 6926)

language-validate (PID: 6930, Parent: 6926, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6931, Parent: 6930)

language-options (PID: 6931, Parent: 6930, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6932, Parent: 6931)

sh (PID: 6932, Parent: 6931, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6933, Parent: 6932)

locale (PID: 6933, Parent: 6932, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6934, Parent: 6932)

grep (PID: 6934, Parent: 6932, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6935, Parent: 1)

polkitd (PID: 6935, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6966, Parent: 1860)

dbus-daemon (PID: 6966, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6967, Parent: 1860)

pulseaudio (PID: 6967, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6968, Parent: 1)

rtkit-daemon (PID: 6968, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6977, Parent: 1)

agetty (PID: 6977, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6978, Parent: 1)

systemd-journald (PID: 6978, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6979, Parent: 1)

rsyslogd (PID: 6979, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6982, Parent: 1)

systemd-logind (PID: 6982, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7040, Parent: 1)

agetty (PID: 7040, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7041, Parent: 1)

rsyslogd (PID: 7041, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7042, Parent: 1860)

pulseaudio (PID: 7042, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7044, Parent: 1)

dbus-daemon (PID: 7044, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7048, Parent: 1)

gpu-manager (PID: 7048, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7049, Parent: 7048)

sh (PID: 7049, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7050, Parent: 7049)

grep (PID: 7050, Parent: 7049, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7051, Parent: 7048)

sh (PID: 7051, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7052, Parent: 7051)

grep (PID: 7052, Parent: 7051, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7053, Parent: 7048)

sh (PID: 7053, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7054, Parent: 7053)

grep (PID: 7054, Parent: 7053, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7055, Parent: 7048)

sh (PID: 7055, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7058, Parent: 7055)

grep (PID: 7058, Parent: 7055, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7059, Parent: 7048)

sh (PID: 7059, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7060, Parent: 7059)

grep (PID: 7060, Parent: 7059, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7061, Parent: 7048)

sh (PID: 7061, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7062, Parent: 7061)

grep (PID: 7062, Parent: 7061, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7066, Parent: 7048)

sh (PID: 7066, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7067, Parent: 7066)

grep (PID: 7067, Parent: 7066, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7071, Parent: 7048)

sh (PID: 7071, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7072, Parent: 7071)

grep (PID: 7072, Parent: 7071, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7064, Parent: 1)

rtkit-daemon (PID: 7064, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7070, Parent: 1)

polkitd (PID: 7070, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7076, Parent: 1)

generate-config (PID: 7076, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7077, Parent: 7076)

pkill (PID: 7077, Parent: 7076, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7082, Parent: 1860)

dbus-daemon (PID: 7082, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7083, Parent: 1)

gdm-wait-for-drm (PID: 7083, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7088, Parent: 1)

gdm3 (PID: 7088, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7091, Parent: 7088)

plymouth (PID: 7091, Parent: 7088, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7101, Parent: 7088)

gdm-session-worker (PID: 7101, Parent: 7088, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7107, Parent: 7101)

gdm-wayland-session (PID: 7107, Parent: 7101, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7109, Parent: 7107)

dbus-daemon (PID: 7109, Parent: 7107, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7116, Parent: 7109)

dbus-daemon New Fork (PID: 7117, Parent: 7116)

false (PID: 7117, Parent: 7116, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7118, Parent: 7107)

dbus-run-session (PID: 7118, Parent: 7107, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7119, Parent: 7118)

dbus-daemon (PID: 7119, Parent: 7118, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7120, Parent: 7088)

Default (PID: 7120, Parent: 7088, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7121, Parent: 7088)

Default (PID: 7121, Parent: 7088, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7092, Parent: 1)

accounts-daemon (PID: 7092, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7096, Parent: 7092)

language-validate (PID: 7096, Parent: 7092, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7097, Parent: 7096)

language-options (PID: 7097, Parent: 7096, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7098, Parent: 7097)

sh (PID: 7098, Parent: 7097, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7099, Parent: 7098)

locale (PID: 7099, Parent: 7098, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7100, Parent: 7098)

grep (PID: 7100, Parent: 7098, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7105, Parent: 1)

systemd (PID: 7105, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7110, Parent: 7105)

systemd New Fork (PID: 7111, Parent: 7110)

30-systemd-environment-d-generator (PID: 7111, Parent: 7110, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7122, Parent: 7105)

systemctl (PID: 7122, Parent: 7105, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7123, Parent: 7105)

pulseaudio (PID: 7123, Parent: 7105, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7128, Parent: 7105)

dbus-daemon (PID: 7128, Parent: 7105, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
dwhdbg.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
dwhdbg.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
dwhdbg.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x129ec:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
dwhdbg.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x13263:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
dwhdbg.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xee06:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xeff8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
dwhdbg.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x16fca:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
dwhdbg.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1bc26:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
dwhdbg.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12e23:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
dwhdbg.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11d22:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
dwhdbg.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x130ee:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
dwhdbg.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x11f1b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
dwhdbg.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
dwhdbg.elf	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1e45e:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
dwhdbg.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
dwhdbg.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6fd2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 10 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6270.1.0000000000400000.0000000000421000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x129ec:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x13263:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xee06:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xeff8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x16fca:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1bc26:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12e23:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11d22:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x130ee:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x11f1b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1e45e:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6270.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6fd2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: dwhdbg.elf PID: 6270	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: dwhdbg.elf PID: 6270	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x198c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x19f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1a90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aa4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ab8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1acc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1ae0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 12 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6506)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6652)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6746)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6819)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7041)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6481)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6618)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6640)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6818)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6885)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6922)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6945)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6978)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7088)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7109)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7119)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7105)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.304.dr, syslog.44.dr, syslog.185.dr, syslog.197.dr, syslog.135.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: dwhdbg.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4499, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4501, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4505, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4533, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6079, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6270, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6277, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6410, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6411, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6412, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6504, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6506, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6618, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6745, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6481, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6748, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6818, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1886, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2014, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2038, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2180, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2208, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2289, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2302, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6504, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6648, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6819, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6821, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6885, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6905, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6906, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6922, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6966, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6967, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6977, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6979, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4499, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4501, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4505, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 4533, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6079, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6270, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6277, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6410, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6411, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6412, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6504, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6506, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6582, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6618, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6650, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6651, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6745, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6481, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6748, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6749, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6818, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 1886, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2014, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2038, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2180, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2208, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2289, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 2302, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6504, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6648, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6819, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6821, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6825, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6885, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6905, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6906, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6922, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6966, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6967, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6977, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6271)	SIGKILL sent: pid: 6979, result: successful	Jump to behavior

Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: dwhdbg.elf PID: 6270, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/163@19/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6492)	File: /proc/6492/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6597)	File: /proc/6597/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6640)	File: /proc/6640/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6645)	File: /proc/6645/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6654)	File: /proc/6654/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6747)	File: /proc/6747/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6820)	File: /proc/6820/mounts
Source: /usr/bin/dbus-daemon (PID: 6945)	File: /proc/6945/mounts
Source: /usr/bin/dbus-daemon (PID: 6950)	File: /proc/6950/mounts
Source: /usr/bin/dbus-daemon (PID: 6966)	File: /proc/6966/mounts
Source: /usr/bin/dbus-daemon (PID: 7044)	File: /proc/7044/mounts
Source: /usr/bin/dbus-daemon (PID: 7082)	File: /proc/7082/mounts
Source: /usr/bin/dbus-daemon (PID: 7109)	File: /proc/7109/mounts
Source: /usr/bin/dbus-daemon (PID: 7119)	File: /proc/7119/mounts
Source: /usr/bin/dbus-daemon (PID: 7128)	File: /proc/7128/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6272)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6272)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6277)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:76031kdFfJg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:76032w51X6e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:76193Z13aXf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:76302AQwdof	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:76307ZHvYZh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:765968MRHWh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:7660567kd3f	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:76719Znjbyh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:76790yQ3aSh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:77883Htcozi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:77944ByjnOf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:7802656RfUg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78176WEEApf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78188l0rZyf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78218Ae4u6g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78220MAFwXg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:7824858Nd5g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78249kPgf2h	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:783079ymTCg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78394iOFOEi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78464N3COwh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78480HdcYKh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78577UbK28f	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:79266Vf5XVe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:79344tStrPf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:79431Rjp8Ce	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:79515mRvDNe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	File: /run/systemd/journal/streams/.#9:78847lFh8mi	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/seats/.#seat0A7gTkT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#127f15RQS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#127Uz9EdS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/seats/.#seat02zlXTU	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#127ylvvkW	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6516)	File: /run/systemd/users/.#127vsjqNV	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6578)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6638)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6623)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6623)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6666)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6666)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6666)	File: /run/systemd/seats/.#seat0wmQxvh	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6828)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6828)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/seats/.#seat02CnwBu
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127Oh8Xhx
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127emm9Qt
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/seats/.#seat0fHPagu
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127yajm8u
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#1274LW6Et
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127Mrse9s
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127KgzY7u
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81097zEUvxN
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81104dB56QP
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81110SYRo8O
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81117qZPKIN
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81125EPAczQ
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81126GQSTkM
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81204aQRv8O
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81285SXyiDN
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81372pEoYAO
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:805330wJ77O
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:80556HMW4DM
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:805576qxPnN
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:80586jjNGjQ
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:80587Y8HLgM
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81629tOBfOM
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:816725rGezQ
Source: /lib/systemd/systemd-journald (PID: 6885)	File: /run/systemd/journal/streams/.#9:81787CS8pEN
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6943)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6935)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82675gtRRWR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82677TD9BeR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82678zbFVCQ
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82679tirKAQ
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82697anUHaS
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82704eF6GxS
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:827058CC9BQ
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82713koOpZR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82714FacH0O
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:827152eKrDP
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82716yNHvcR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82813fT9BTR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82818SgHL0Q
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82854axACSP
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82855EYcCrR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82889exBSuO
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82891riQGrR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:82894EnrUcR
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:84009fQnm5O
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:84012In34zS
Source: /lib/systemd/systemd-journald (PID: 6978)	File: /run/systemd/journal/streams/.#9:84063fkXepR
Source: /lib/systemd/systemd-logind (PID: 6982)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6982)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/seats/.#seat0kZ59t8
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127Tfg0V7
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127DwlMv7
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/seats/.#seat0axNuU8
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127Y6eG56
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127eQTae7
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127LmOSq9
Source: /lib/systemd/systemd-logind (PID: 6982)	File: /run/systemd/users/.#127AlZ8a8
Source: /usr/lib/policykit-1/polkitd (PID: 7070)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7107)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7092)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7092)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7105)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7111)	Directory: <invalid fd (4)>/.config

Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7044/status
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7044/attr/current
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7088/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7101/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7101/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7123/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7123/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7023/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7023/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/6982/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7105/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7070/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7092/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7042/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7042/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7042/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7064/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 7044)	File opened: /proc/7107/cmdline
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/6234/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/6234/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/6235/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/6235/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/3088/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/232/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1699/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1335/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1334/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/2302/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/115/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/236/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/116/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/237/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/117/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/118/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/910/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/119/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/912/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/912/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/912/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/10/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/2307/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/ps (PID: 6412)	File opened: /proc/2307/cmdline	Jump to behavior

Source: /tmp/dwhdbg.elf (PID: 6411)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6905)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6590)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6593)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6601)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6606)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6608)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6629)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6661)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6725)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6728)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6730)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6732)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6734)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6736)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6738)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6889)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6892)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6896)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6899)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6901)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6903)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6907)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6909)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6932)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7049)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7051)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7053)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7055)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7059)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7061)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7066)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7071)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7098)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6587)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6591)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6594)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6602)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6607)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6609)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6631)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6662)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6726)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6729)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6731)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6733)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6735)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6737)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6739)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6890)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6894)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6897)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6900)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6902)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6904)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6908)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6910)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6934)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7050)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7052)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7054)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7058)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7060)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7062)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7067)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7072)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7100)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6611)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6741)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6914)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7077)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6412)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6906)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /usr/bin/dash (PID: 6245)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Xzkzx4hmrD /tmp/tmp.CJEPg7VdSm /tmp/tmp.xG4NGhTGYp			Jump to behavior
Source: /usr/bin/dash (PID: 6246)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.Xzkzx4hmrD /tmp/tmp.CJEPg7VdSm /tmp/tmp.xG4NGhTGYp			Jump to behavior

Source: /lib/systemd/systemd (PID: 7122)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6412)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6906)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6818)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6885)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6978)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6582)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6651)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6821)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 7040)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6618)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6618)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6623)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6623)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6922)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6922)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7088)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7088)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7092)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7092)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6506)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6506)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6585)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6652)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6652)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6660)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6746)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6819)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6819)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6886)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7041)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7041)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7048)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/dwhdbg.elf (PID: 6270)

File: /tmp/dwhdbg.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6585)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6660)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6886)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7048)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6412)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6906)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6504)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6611)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6741)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6914)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6967)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7042)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7077)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7123)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6277)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6481)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6504)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6506)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6582)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6585)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6632)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6651)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6652)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6660)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6746)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6818)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6819)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6821)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6885)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6886)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6939)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6967)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6978)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7040)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7041)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7042)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7048)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7101)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7123)	Queries kernel information via 'uname':

Source: kern.log.44.dr	Binary or memory string: Dec 4 13:05:22 galassia kernel: [ 485.085364] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.44.dr	Binary or memory string: Dec 4 13:05:22 galassia kernel: [ 485.085394] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.304.dr	Binary or memory string: Dec 4 13:07:08 galassia kernel: [ 590.754921] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.304.dr	Binary or memory string: Dec 4 13:07:08 galassia kernel: [ 590.754949] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6623)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7092)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dwhdbg.elf, type: SAMPLE
Source: Yara match	File source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwhdbg.elf PID: 6270, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dwhdbg.elf, type: SAMPLE
Source: Yara match	File source: 6270.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwhdbg.elf PID: 6270, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
dwhdbg.elf	53%	ReversingLabs	Linux.Backdoor.Mirai
dwhdbg.elf	100%	Avira	EXP/ELF.Mirai.Z.A
dwhdbg.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
raw.cardiacpure.ru	178.215.238.4	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.304.dr, syslog.44.dr, syslog.185.dr, syslog.197.dr, syslog.135.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	atlas.mips.elf	Get hash	malicious	Unknown	Browse
	main_x86.elf	Get hash	malicious	Mirai	Browse
	mpsl.elf	Get hash	malicious	Unknown	Browse
	spc.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	aarch64.elf	Get hash	malicious	Unknown	Browse
	arm.elf	Get hash	malicious	Unknown	Browse
	arm7.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	a-r.m-6.SNOOPY.elf	Get hash	malicious	Gafgyt	Browse
162.213.35.25	iwir64.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	sshd	Get hash	malicious	Xmrig	Browse	162.213.35.24
	armv6l.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	mipsel.elf	Get hash	malicious	Gafgyt, Mirai	Browse	162.213.35.25
	sora.x86_64.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	rbot.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	UnHAnaAW.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	atlas.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
raw.cardiacpure.ru	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LVLT-10753US	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	rbot.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.sh4.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.arm5.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.powerpc.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.mipsel.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.i586.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.i586.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.arm4.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.mips.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
AMAZON-02US	sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	75.2.109.180
	https://clickme.thryv.com/ls/click?upn=u001.5dsdCa4YiGVzoib36gWoSLMas8wKe7Ih4zqBiyHkarn0j5lOr9uX2Ipi5t6mu5SV-2B1JsyP5-2FhfNtTtQOlKj0flyS3vwLeKaJ6ckzVjuZims-3DLeyB_UNbDpVWBvKTmUslwem1E0EC2Cp68hMzvjQfllUT9E4DZqDf2uiRmAk3QSMceJiv-2FShXGXSXiT9Fl37dFQYscKLxEMcTJj4tm5gMav6Ov9aTBg62vcUAgkYbCAf46MpAyc7W7GFqvL6adNxNCTlmXTIiiRHR0fGeBxBsxNA5VbYoJQJb-2FJYi0QkLgjAoVYrRvTi1dn7pPo7PbeQWMcs70s7UFE7WeCgk9rDpKP4binyuu0CEbckceaS6ycGVUXPi2325g7v8hitus3ay9MICEoPWHxYePXARIxPiq-2FS9xmhqxVG-2BsRc9-2BU2VqX-2BZB9nYYuSKeNDIvkVaXKl7x-2FFSxF7xXa4BaT30eg9SUGZbRvZ8-3D#C	Get hash	malicious	Captcha Phish, HTMLPhisher	Browse	3.160.188.72
	sora.mpsl.elf	Get hash	malicious	Mirai	Browse	18.157.229.249
	sora.mips.elf	Get hash	malicious	Mirai	Browse	34.209.36.234
	https://assets.website-files.com/65f01d0a723f74809a242153/66338b2a02c52612263308af_nuwezanusuxukejeselored.pdf	Get hash	malicious	Unknown	Browse	13.248.169.48
	atlas.arm4.elf	Get hash	malicious	Unknown	Browse	34.243.160.129
	atlas.mips.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	http://hissingkitty.com	Get hash	malicious	Unknown	Browse	3.17.87.133
	https://sink.iki.my/	Get hash	malicious	Unknown	Browse	76.76.21.21
	17333253674c71ac3d5875ca830e11f4630bf65d3b8b7e2686361e216df980d330c80afb30623.dat-decoded.exe	Get hash	malicious	Remcos	Browse	108.139.47.108
CANONICAL-ASGB	debug.dbg.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	rbot.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	UnHAnaAW.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	atlas.powerpc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	atlas.mipsel.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	atlas.arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	atlas.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	atlas.m68k.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	atlas.i686.elf	Get hash	malicious	Unknown	Browse	185.125.190.26

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6643/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6948/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7117/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mdtn:mH
MD5:	AE971F5145D20264D6A7695C4F91685F
SHA1:	C78A90F87A4612A7BDDAD419B6F7DF879977BCF1
SHA-256:	93438D7E76DDFB404B3873262C38A50A9E04FBB71EF9AC167C00A1A3AEA7EDE7
SHA-512:	E049ECE9A3F1AEBE531F3BDA4B9E516F20B76C08C95DEA72F11611E1532A055EE8125395EE353F29A7312900EED32CB85B6CB48B64227B540F39EB708C575AAC
Malicious:	false
Preview:	7088.

/run/systemd/journal/streams/.#9:76031kdFfJg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.482414810125274
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/rLdEc1TTqdh+sjsv:SbFuFyLVIg1BG+f+M9dTTWTji4s
MD5:	703ACAA0970D77CA5EE815F91161D2EE
SHA1:	2FAF22EF1F74B954A8A716F232CFDCC3C059BC30
SHA-256:	4109CF89C8FD0C1EFEB98DF7E35121A2F516E14C8A1278D9A87C9F20668C7B3E
SHA-512:	81708FA5B4E559E288EAEAB9A505979322E45F8FBD5BC6C922EAD63646DFF9BBCB9D10DD904245B9B6872440B0F8E5E333908F4D2CC6BD525859FB5D780C4FFC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=56aed3dec98f4315859ace94c6a868e0.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76032w51X6e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5394116691366575
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzHGSU1WXMeKX1sjsv:SbFuFyLVIg1BG+f+MrGSUEXMeKWji4s
MD5:	654443E60862B43791EBFC29CE15F4E7
SHA1:	6B2123C3848C16EBC0B587B1760E295B38939947
SHA-256:	5F362D5E506C30F7D389BCF6D5390FC7B48A2BD409E92434C3BF91ED559BCBBE
SHA-512:	22D115E7862D87DE344EE776B26D5053E9E1EB97BE9BF5665125E6786BC00C280853C78D0CC6CBF84FEA06544CC825894B48E900B877F002FD5FC26099A0E9FC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=97d05c71a94f4fb68e213d707616bdd0.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76193Z13aXf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.425500000964751
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MouehVEyG6YTjosQu:qgFq6g10+f+MoueTEyGPQu
MD5:	9F731E42B5ED232ADAAE22B1CE724F46
SHA1:	CA5EAFF4EF7EC51780DA4BAD8C3C7FC2B9B7E4DE
SHA-256:	DBF76264170FBB86E2B77E3A5515B6B4CF6F8FF45EAEF375A202A1347ED79D7D
SHA-512:	0CC0D9CDC671E53CC8DB684B3E139EB8974E9BC6C3A11A403024018758E8DF76ED4894569A4C10B261F36F808D1B6B145032E1355174896990C756321151D037
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b559d312c3894b9a8c7ae0fb381c11f9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76302AQwdof

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.421456753888204
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M69NSE83AbjdCLKzK:qgFq6g10+f+MoVCLAK
MD5:	F38D5707010350D1F0AECC9D1516A231
SHA1:	0994E61B2469DAAF4D47D37ED0867F88DB447119
SHA-256:	90D551950EB2E5F3B30597D795E83B3EB2364003B1DAD72AC919EB6E9DCE7FF6
SHA-512:	BD4AB9C783EEE08E5827E9A9843B1CF62CBBEA45D4368A2958ACC55EDFEC8407FC09EFBF3E090E9E616E234DA5EBEE20AD8D119319A7D287943CC44236E0A44F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0235fd117ac9467484b26c2cd3df2ebb.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76307ZHvYZh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.380848772033975
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4g6Hyi2xdEXENrxsh:SbFuFyLVIg1BG+f+M4gXxGKrqjtWL0
MD5:	0CA8B12CDD302636C6E7C11C755BE8FE
SHA1:	20C36724F48183B332049A63B51BCC1DB560F87F
SHA-256:	DAA534E121993BE11B574EE456F1026581D65F27CB8620C2BA289A70645B43A6
SHA-512:	09902A5EE1C03C16D7A70B763A11987BE5FF861A040B922EA89DEF3E438380F134B6D6C0E9D884787088422F2AA39FEA92AF4148E1183C26704E6D53201DBCCC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=24c05b99e1d940fb9c18a6679fc78a2a.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:765968MRHWh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.3586834486963655
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuX7X4Vs0g2jsjOdlE:SbFuFyLVIg1BG+f+Muro+IjNE
MD5:	31EB3C8DFB4C6AC174CF747A3F31BF3C
SHA1:	BB095932118125BCD0E5717E60EBC30697F6128D
SHA-256:	93AFB31903FD135E738BC8D2EECDCB1482917BF5462A9752C575DB65FBA196D1
SHA-512:	AD81AAAFDDC970B0B2F7F3E38BB10B506EDC3FBD8EC619814778576D444B80FD180AC0B6235D446A2D7E5F9974FD824F99E47CC406C5F5719D188A70F82D4065
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ddaa41fe4c3a410fb30a9afcd3ba5bc5.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:7660567kd3f

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.424383831746127
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MywnDGCueTjZcHcljX+:qgFq6g10+f+M8C9RmAu
MD5:	3340724F40017A4CFD4CF3E6C216B75E
SHA1:	46FEE6946CDED037A1040210BACC824776AB204D
SHA-256:	C4CD2FBFB7CB6D61F8076E24C98A550549D42A6EEA24EFB1CE2DA835656A5EA4
SHA-512:	CA859594009BAED5BCA8D107D90CFB37F9A8B32389778B33CF8A827AFC6656797209219FAAF7D73CE2EBBD035E36DCB44FAF3EFF6934D8B8CA97693E291D756C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9aeac31a0de4de2b62bcc014604a5a7.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76719Znjbyh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.382757674683189
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5Q1GRGO/e46LE38j0:SbFuFyLVIg1BG+f+MO1RO/4LE38jbVC
MD5:	758E01DA2EBD6F3B4156E110881E3214
SHA1:	CF96E737CACA0078C09E711B954A5BBDAAE9978D
SHA-256:	6CEB988C938B6B5F38F20CC237A47A47BBE74B77A731A74C9A2B09FD21DD43B1
SHA-512:	476AF15E3487807E2EBE514349A49C944111A90EA9BB6586B5A5AC297465F59555D8D03B4ED69E6F9D444F2C99EA14B5730FE365C605F3E9A5FA2A874E60C378
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=32ea9c4c418748e1ba4496b2176ceaae.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76790yQ3aSh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.393214912633748
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6HVSwvxdHD8jswkCM:SbFuFyLVIg1BG+f+M6Mw5FojLkGq
MD5:	07C63D76C792477676FBB05F8C35F0AC
SHA1:	C4B1665F4F01553648B6739AAB0CA71170E8AF25
SHA-256:	9C6DF5FFB26FF3036E0960FCC48D48AA6491E3F65265A72FD75270C695B9DA27
SHA-512:	A13E9947A38F8895C256293BA8DE2B0163CA2CC28E48E53506CF3079D7FC6C0B4384614FD95136EFAC5A0FE78A520D7E067B4A37C1C443DA3CB5F464E22A00F1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=06228d05b08243689d7d88cc0053db7e.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77883Htcozi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.437044683981279
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm91L4UQQdI2lsjs2ALAQ:SbFuFyLVIg1BAf+MvCQqZjNALyAZD
MD5:	73AF12583F2509B6565651EF7FF89242
SHA1:	CAFFCF278B6F518B841FDD3EBD1A814840EDAE26
SHA-256:	978227D28CFECEDDEAD5A7CA8BB862CAE059BB328BB7604953709D153C53947C
SHA-512:	03B1E1AEF809A250674846843FD2E3E0EFC62483C71B67FBF99C52BC7B63F064EECA53A9F34789746578BF5FE1F59033013CC27CA160CA4949A0B4E923F8B4F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=77c9856724814c3f8c4ddea75cb8e4e0.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77944ByjnOf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.447657868663677
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyDGxcEHkKRUC6js2BbM:SbFuFyLVIg1BAf+MyQcu596jNdQIeXD
MD5:	39AB6B0E9425B33B46E7B6629FF545E7
SHA1:	8F2C6A3BF83AE4E8D68E5D16B46C86FD0AB171ED
SHA-256:	55D2AB1DECF03DA57229896CD42A6D8CF87EA55ACA5EC92B2E159C2A2B00E19B
SHA-512:	53F1900A91C00C1541154BCBFA477E4253543A388D7DBDA5D07CB40DC49D4D34E42B101D2A42838F929B522631C036908DF9E1E605C7AE5A8C751ECC8691E6E2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=83ac9e3a222049abbac67ade70f41c04.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:7802656RfUg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.440831036254436
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6kA5cFVWBgqjdCt/rRMtq:qgFq6g10+f+MJvWBggCDL
MD5:	86E855A7C0DAE8B46777F3502AE3FF43
SHA1:	50FE60F9340F6DBC72FED4165305BAD0FEA58EC3
SHA-256:	B9776DFC4F373AD1C0B117C117571A9B0C80DAB6976874032A13AB642E61006D
SHA-512:	7F2D5B2DB6E83A4488FA48A197FDB33D1D20152CB16F740F9F2A29EB9C7A9CE4F0707F97BC7E22378C4ABB67F1729842B441CB3627F2C4D44E2F3256A7B6A5EE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=090ee292d4f647cdaf594c93ba603dd7.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78176WEEApf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.385211552567476
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7AEC3QEnCpTKdHqjs2R:SbFuFyLVIg1BAf+McENECUdKjNTZD
MD5:	DF20286D0B21EBA6DC088EFB0B27FFF0
SHA1:	D736D37E0A933F1380184CB931BBB13017813617
SHA-256:	095FFE0DC6AE77C70C298259DEA887ADB801B1CBE7FC1C581D1B0B20F9DD84BD
SHA-512:	FF09BC10EF35028C1E48119893020EB66D537D66A069FCA43040ABE62C0EB980EDBB3C781F0B3C006E27D4A4DE4D8DF19FB0E9B438272C04705FF3143AE9751F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=125ad83efe554d438bfdef526c884b4d.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78188l0rZyf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.471271891083679
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MAVau7OIjLTTIWTIL:qgFq6g10+f+MAVH7OoEWEL
MD5:	14565146800F5F87127FC9559EF04B71
SHA1:	04B7B1BF07C8C62F397B036B64703C95723422BB
SHA-256:	B4517AF32EE3AC578091B64E3153C149EA6011743776A0FA3A543271D9C4113E
SHA-512:	0C3C0EFABD3E3596B2F2725F8FB91A46B3A50AE7A9319F05BCB3524E6095E197B1B5323588B4FE2C9A10BE76EB18C5A9E93E00BBAA6D6C95298270EF02E4C2FE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=17bf674b81fc42f18b02de5ffb046d96.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78218Ae4u6g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.406676321853621
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4WeORAQHXW2js2q:SbFuFyLVK6g7/+BG+f+M4WeOygjNq
MD5:	5E0B7B4FE0044F7EE8EF0D69A6695555
SHA1:	C805AC486C69DB50E3808183A124E10426826437
SHA-256:	2C5559D5D3353510372231EA88BBB3001FF89B209965EA292E036E16BC56A1BB
SHA-512:	22BD2F53CDEF8248A7FF0B4599D4A926B03348BAB181092D10360ED5AD91EC7E481C22B3215B77C15B43A6B5BD04C5D9DE6F4648795F17E23EECA24FE999CF53
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2819309f29944fd0a2d505b806149e15.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78220MAFwXg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4182899757330585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/XSUXIDiwsQpsZQ:SbFuFyLVI6g7/+BG+f+MvS3+jNq
MD5:	7EE3F452ECFCB5D124CCA13CAB416CF5
SHA1:	B13543AA283CC0569B385E9D7D560096A5351F68
SHA-256:	8A6669899A0A594DC29380057A4A04A9E3B9AE3BEE24DA92341AF236AE92FF17
SHA-512:	B2C7265F7055736D56C1E5FBEB641523E9B3422CFB5D5E0319A76FB1B801FE4CD274393C443B7F046FFC6527F2C374380487F9A59A5FE033325D9A761E427EEC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5013f777180142f79d130fd05cc81eb7.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:7824858Nd5g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.532516513573855
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MUiAEjFQMzKaBu:qgFqo6g7/+0+f+MUzOTmh
MD5:	48EBBBF11B2466B4363948828A42DCE2
SHA1:	82A1D8EBBBC620CFD2C3A430817BB05ABF0847F1
SHA-256:	913B7A89C5712B5E07C20D9F963C9A8EA3B47C44B731EB061D14CEA3AA52230D
SHA-512:	2B6B962F4CE6BC2C3E7806B56D6A8325C9062DE32B147ECF85ABD209495CAAF6433F4B17197F1079DB83E5E7D0AAED54F12398E926476E2D2895BA7C6A0FA54C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b13be49551e471e9880316192f56398.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78249kPgf2h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.539396720421742
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8DckXAgEQ0xZjFQMzKaBu:qgFqdg7/+0+f+M8ANTmh
MD5:	BB51B3BBDB5F7E9B0125ADD9E9407662
SHA1:	AA8048C77BD314D2997D9474823CB98F943BC27D
SHA-256:	306DFE212842D22D767901FF248801F8BEB3D7603BEBBA4BB59C853290D367D0
SHA-512:	654735AA909A290F6355AD53F06F023A22B750DD43E0442021CCDCDA85A3C7FC1ADE8EC9DADE8D058F6DA523EDFA2281697800FFDFACEDFD0856D4DB0FB819B4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6f9ba7cb2e654eb1a382688e95cacb93.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:783079ymTCg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.359453883925513
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmunv2Tdd7ABzzVXsje:SbFuFyLVIg1BG+f+MuO3kujdCLKzK
MD5:	1F8D48B628D1725772F12B4AA6AD3DFA
SHA1:	DB8A3BEED041E3BF4773BE37E64032C7C07FBAFB
SHA-256:	617D445EAF15306C87D7F7A8BF8928156160433691FD6BA3822BAEBE238C0E4D
SHA-512:	C7FFB60DBDFBD611B52CE050BF71F7143EF6B69DE6FF592FC6984D9BC793F4F25FFEA25697A5052ED9E4415E5B20F899FE53382C3AF1ED5AD7601BE45D33D3EA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=db10cb13096648be98bc2d40d94ac98b.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78394iOFOEi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.363254828816419
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4qB5cccXRiQE65rqd:SbFuFyLVIg1BG+f+M4qBCtXn5rqjosQu
MD5:	13A46B5252ECC6AA5746782906C3EFD2
SHA1:	2463DFFAC6470E50CB01F786D4052115DCBC387C
SHA-256:	87705BF2BD271F9DB9F65170397AC93A270AAD15D349357347A9EA1C3C1B85E5
SHA-512:	D736CB862E523016F20F1C41F6B74CCC8BD2B8A8122312645329CE0F53A6AC3B3D5A55239C62745A6CAB943E3276345B32235B0AA3AEC3EB22538CB251B5DB04
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=20ed7ebfad1d49fe924d1bb5ab5df30e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78464N3COwh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.389260282676571
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuhhXU0RTS8sZjswkT:SbFuFyLVIg1BG+f+Mu7E0RT18jLkGq
MD5:	AB25A754F9EE085846B60ECEA5E2D924
SHA1:	BEC97DAD1D338FE79394DCB8A5D6FF3EEB510ED9
SHA-256:	F7FA3D19DEA7BA91A04740608E98565E0E5F812B498A2E594C316DF3EC5C17A6
SHA-512:	4E787A71FF03BBEAA886C9117F82BB1F9AA58CC9886BBD693C770BA023975812ABEB961331C2FEFA881D1A8EB6A603EEB852C8F715265702679B1B24B98F9304
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d257477210234ba4a0908c1efd4070f9.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:78480HdcYKh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.359342885914435
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm70RBstUlvXucYXsje:SbFuFyLVIg1BG+f+MQR6t+PPjdCLKzK
MD5:	DFC37A317C154B4632A5CC1FC2182A30
SHA1:	74611B94E7EDF859585BA2ADF59204DD41EEC511
SHA-256:	2869FFB0AE74A52C7082A9AE7BF3F4017BE267937C8D9A3795B352B3B4AE48D7
SHA-512:	764352C205734A2BCE0248E93FFBA25CFD34D55FACFD10195CB7653DC48855ECE2EA42F7FF4D08BCC16A229C9CAD3CED0EE528337E98023B2913D03D8B8B497A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=11c94df225ff44ba9b21d6aed2ab9aa1.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78577UbK28f

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.497596447865385
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+My0QIslPaCRqjZcHcljX+:qgFq6g10+f+MJQIsNkmAu
MD5:	56AAB58271E3C713EA64FCD18659C270
SHA1:	14988E11D328545B5955D71C0E30F10D8779FAFE
SHA-256:	9AA9C6A8A15FB178D54F02C71498DE042A615EE4035100820378ECF8D337A466
SHA-512:	B64CE7FEB5618C6E0ECA5DC1B93D977601EC5B43C6BCCF0F76E6595AB41CC465158A14C04A2C90A25FD4F68C549E03F8A8613F4F530BE94675CC0ED1165501BC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=86e6ba147b814b9f88554f6f38f46461.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78847lFh8mi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.479383220246627
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+MQ6gXfN2jZcHcljX+:qgFq6g10+f+MWfYmAu
MD5:	E1676E7CF664EA770FE5377A0E474B83
SHA1:	14FAF33FF27A0E7607EDB5370F40D14B63D28521
SHA-256:	CD673F3799728EFCD39B236653DEC5D0443AFD53ED2C5C007CFFF1CA6C9AC3ED
SHA-512:	BF87DDAF1903D2286EDF8AD0D49E6DAB7C16D6038FAC0F58A866EB77A3456F82C1C6260BCAB526EDD25836360CCC80739B3CD71737F427FF9BFEE945D0F3173C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=41c47595275a4be28d398a21aee32d60.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79266Vf5XVe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.448902898246389
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7nTHDHXTDbcsjs2ALAQ:SbFuFyLVIg1BAf+MHHDDDbdjNALyAZD
MD5:	4595849E38ED8CC420EA44C6BB15C583
SHA1:	A8895D9A221F872B12D8D8ABDEB11F6C76476545
SHA-256:	87D2F4CA8C6DB93F85ED754AA9E68520DEE7C6F5BED11550D1CAD1EA0798341D
SHA-512:	719F1689B779288CA153EF2642D739E351AAE07E49CC4BE959948611344AD2E71237EFBA50370006258F8A870103E64A25CBECEF8A78F8DF1B20DBB8877DD488
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d46bfb2a7264d2c918558aaca37ecd2.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79344tStrPf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.478404224270379
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzPE0QRX2hpHABTBWUsA:SbFuFyLVIg1BAf+Mo0fb91jNdQIeXD
MD5:	30D160E6BED7D65CE8D267F221B17A1D
SHA1:	30DB6857C97F50BBB30B44F3229B72E5A95F34BA
SHA-256:	86E8D8E93D081B30580EDD08B6BBBF3CEDF398024E91AECBD403287047ABBCF9
SHA-512:	B3C4E8ACF027CF4BAE1742D884799853D5DAA1B445EDCB9C80A09CEC62FCA45E244BE066B05C9FC1B90DCD500CD722F2FF8D5E0737E1AD348056A1969698CD87
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9e94a68ef5424554a6175bcbe246d81a.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79431Rjp8Ce

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.432793600019471
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9WThF0wT6F2js1Ha7:SbFuFyLVIg1BG+f+McdF9T6F2josQu
MD5:	477323F7A49A0E82720043B8AB4C2360
SHA1:	63D7F4BD90AD1BC9EC88FF95BB62441B4C6DD241
SHA-256:	D81F8BCA495BC59EBFE9504287361A3961D78EE8F68C2FE9C267354436333A86
SHA-512:	0811739563DFE98DACA975F35D35F60E3E7891881F7560B0F08DF2821FF4A7040DF950C1B94FD28839AA2BE732C8BFE85054C9952D6969910A9900832C6D63D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=78162a952f924d4caf66ea32bbb6962e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79515mRvDNe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.380638364485929
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4PEXUNsUscMUnihTS:SbFuFyLVIg1BG+f+M4LN7Vn6jdCLKzK
MD5:	0F3609E595F18801DE7A03016C3B13FD
SHA1:	75524ABB4F88D5FE125DBD8B41A8F22E5331DBB6
SHA-256:	9620B154CF16B1DF19C4563BE6000725AD90940E582DC463B7067870DDD0BFD1
SHA-512:	3FFD0F6B706CA424BD2EFBFFB8E181F9BE0554061DFADE4B87B5B3D2ED5504A7E2013B2BBC4A77FE554986EE2B1BFF0C935ABBDAD2A350D5700AB262B068ED68
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=29e0fa2d8e264612b107489b1dd10cc4.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:805330wJ77O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.413048162771868
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6E72B1AcLVjETjbVC:qgFq6g10+f+MZm1AcLVjEM
MD5:	68BAACD101E4EDC83B50C21E99A096EB
SHA1:	5EFCE79398B1ED3A899922B6552A3C152C812895
SHA-256:	129D6DEE9ED569317D252F9E1797ABB9816F674915026C2383AA8D8D236A2EEB
SHA-512:	C17AE7D8C76B112B2987A690AE1E6C16A42922F4DB390669CB197220A37A04C7F531C1D54D00A24813C336354ADED2071DF01FD4A819FD000145F321AE860AD5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=018daa61c9bd46c29408e90cb543fc53.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80556HMW4DM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.400423599038883
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MWfVEXHDtBt3EFjNq:qgFqo6g7/+0+f+MWN+jtBt0q
MD5:	D7A86D2387F480182B783EA12F0E2D80
SHA1:	8F9B25347EC381FF753DEE9E85C836A219B1CA0C
SHA-256:	D076430811C9B7A1FE45C3D9C16DC2C7DAA038D28581B4BD916F7DC74A60B3AD
SHA-512:	535EC3FD4098E84B6A5F1C26165A22CC4FE5240F3940894094BF3795E5EABBE10F762CB1D56D4A11095A83A9AB2EAD86C133101F861B1219D19398157348FEFD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=36a43f09e7f14b25a2bfaadcab2444a1.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:805576qxPnN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.393609237716991
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MoeItCIUqJATjNq:qgFqdg7/+0+f+MoiIDJ+q
MD5:	E44DAC9BC2B73B443256083671532FBE
SHA1:	30FB6A7DB1F4F6CB257952EFEFD62262957A6EC9
SHA-256:	307DC8271B67FEF2E86811E7FBB71BA3868EDAC40721D36180630D175A7BEC29
SHA-512:	61A64C5FB1191DCBAFBCDF24D47E6B309F4E43C4A59CBFCE1BAA21B0F3E0EF9CF64322B61837048C0C057933FED346BF17AAA205008EE51A08C27D8826B46877
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b5452558a294406c8006a5ef819ab694.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80586jjNGjQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.470382582524924
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MYx3/Vv8jFQMzKaBu:qgFqo6g7/+0+f+MC3/Vv2Tmh
MD5:	69DCA20495FA2DC4A4FD02E116D3AE9A
SHA1:	68D18F8B112A6617155D7B1E1E23122B91BDBD26
SHA-256:	51E49E0FF9AD631B7AB58D727287873D06D1E976534F40C1B086574597B54B70
SHA-512:	F9417D8DCE6DABB7D523E9D9E0F991596797095765EE1D7273FE242FBE0F5E0FCB0F003F1BD892BC2FB78DCAB0FBA0272581203D32C8AD13BB1B1317B22FC394
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=727dc27c4d674cc3a9ccc5629dd9c426.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:80587Y8HLgM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5528244302714285
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9JGcDFi+Tjs+QMM:SbFuFyLVI6g7/+BG+f+MyejFQMzKaBu
MD5:	9876AD5C4F8ED43EE0AAADE82DD889FC
SHA1:	0D79EB20805DE8C414A25B32660700849A1BCFE7
SHA-256:	EB3D462EB2065EF4DC480FEEBE4BCB3F662F3C0F863E78524E7A2F9ECEF94260
SHA-512:	FB7D56BAE382579C4D0FB906D0117437DCE864FD1137F08510B1B62D801AB812083AE661F749F048E9D32017FE93122A3EA6C37ACC97AC5E61CFBEA49B033423
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7a12157f0cc94c658dc7589b72671a98.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81097zEUvxN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.49614989403153
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/ljRV0gLGyXsjs7LH:SbFuFyLVIg1BG+f+M9jAXy8ji4s
MD5:	FC9AA2BEADB1BD5BB634FCD9EE715D2E
SHA1:	A9DDB4F30EC4533A6B9DD6DC158452150A9AC31C
SHA-256:	B6249F227D53983217FE4938BFD519B71749DB086CFD5760656C47C93A34A277
SHA-512:	91F8FA153ED567B2FE7C0F763ECFDF786FD3C3CE617E43C9E767081D11D451FE74AD5B1A5628A2CBE3BCF8D4A6FD8E1873CB9B02B885A3EA91212C5F19872BD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=544371634a834d86b46a89461fac4eaa.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81104dB56QP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.412360128509078
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/GknldnPW4xsjs1Ha:SbFuFyLVIg1BG+f+M1nldnPW4qjosQu
MD5:	62839F4B959C07BCADC9E0A9EDEE5CB4
SHA1:	EF560C8A621DE02D240851AF84374BCEDDA5C3BA
SHA-256:	21B6C275AF86DD3EABF9B75CD81C202E4ED9ADADF085C70833F3AFA5868E0AD7
SHA-512:	C8D1408B6D769100F967EAF0AD578D5711700DD558E788670EDDC187584E0570DAA585A4900DA4202F581645EB5CCEDF3D3EFD43CDD1CF2950CCF476D3340041
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5da0729be2c04edb89c2135f65e3ecac.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81110SYRo8O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.327256619064006
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8GAeO705qjdCLKzK:qgFq6g10+f+M8Gy705gCLAK
MD5:	F31AC6B4B69579BE4F1C8B9F4CA77E16
SHA1:	2F356C5468130BEFD1AFAE2347CD7A3CD946A92E
SHA-256:	75A2F283EFEAD573673BFC70B6CDC49C8867638EE0A3D927B3DAACC267C4BD1E
SHA-512:	0C7EC537DA52B648EDC16F577B72924745A9115AA9BC979C4325C9954572887E6079C9C2816F773B39D1A34FD8FDDF9918EB46D163D20B6E432E9FD42B82F48B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=656e487936a3482a88b48a8876eee87a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81117qZPKIN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.457665151662683
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+B04JWXwpjsicWmIo:SbFuFyLVIg1BG+f+M+BzgXGjZcHcljX+
MD5:	D5246F17B140A7078D669B75E55C058E
SHA1:	4B816F91145A57D4D52378C3C24409111D53B071
SHA-256:	242A3585CE4F6C027FB81866856D0CED6260BF50C754A3EEC3E8DC1EBE6962DC
SHA-512:	FBD6F36C0AF3169FD6C72163551C82DDCB18221285BAE9D63869AEF2FB1169057F6BBA06412365BE7DF2A2C202CE587BADDB8EF0086AB66D2E30D272AC8227CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=48b7922c9ada40dfa510c9af3ea24ebe.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81125EPAczQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.430669792542375
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrURdccSSUcytAL+sS:SbFuFyLVIg1BG+f+Mo7ccC1tgTjLkGq
MD5:	915024026D419029AA48074773A5585E
SHA1:	2D01AC794333DCAC826BE11BFF7939603C054B2E
SHA-256:	794CF68FF80F8EF856600480C78A4B70CC0E820CF5A4204D7BC22BC2292E5A86
SHA-512:	3C6C7361D992941F363C6EC7184ADF1BF71C1EF154371A0BBF3768F85C0FC3FE0F0A1A5CE34D29564C73271D53F9D41F84410E433FB1988EE09222D72F77BE70
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a56f48d709554c719b7adbb400d1ef23.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:81126GQSTkM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4409287456715925
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MDrRXTQXtcGxTjNALyAZD:qgFq6g1af+MDrRXcFIZD
MD5:	2077EAF2448A89CB2E7EF9EF16265083
SHA1:	5F7A6DF316723880E775703F3284C3F30D693A6F
SHA-256:	638340C235798ACB2A84A793D3B52A99DEDE4C906F64B3393B26F48F1A612C93
SHA-512:	3B989EDEF1203B1CDEF06D71E83D247802C01B7AAAB5C272E726CF2E48802453BF74661164952C77093554631DDD84C9B5526895E9CA779275CFADF29D8D4BA6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b809a0d5a42460da28f27815fda5cbe.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81204aQRv8O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4795491291053855
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/0VawSWKCETjs2BbQIa:SbFuFyLVIg1BAf+MsVawEjNdQIeXD
MD5:	47B9FA1AC98B2CF91C2302D96DF79B8C
SHA1:	79FED6CFE3FBED4B764E08A8E4E975BCC97EBEA8
SHA-256:	D1340CF506054DC9DC0E1B749F5C59485563D770C0AD76A6AE6A133478462A94
SHA-512:	994BDD15F50E1D695D50AFDF17A2A0731F33975F7090C835141B926B49333D8657026D15A49C08B1C635EEB6DB81280F962B15D4D278C25FAE7682D4EE8CF7FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5e4023539bc24e4cb37149e591008e26.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81285SXyiDN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.339385344131477
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvDGaUx5OuWTfMqjs2BP:SbFuFyLVIg1BAf+MyaUx5OtZjNTZD
MD5:	701C344E8C73BF3DE09E9F00F4DDB2E6
SHA1:	887A91389654A591AB824B4AB0206EF22D14A305
SHA-256:	8D6406083BEA6424CBF4C351F25F41812A50A6BEF80EE863C7FA5885B307681D
SHA-512:	8FCE01E9DF47B3A9258EAD42BC4DD82779A7DEC2DF36BFA0C06A6A0EC2C4EA5866B9D37FE9B526645AB556CCA44FC51FEBFAEF129DBFBB3DB2A2E2463A7E6D0A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec1c3819dae946a0a30e0329591d85d4.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81372pEoYAO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.415575819117009
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MCOXRIYcsjLTTIWTIL:qgFq6g10+f+MCc95EWEL
MD5:	622645A3F08AE458FC9E2D71CDB9B206
SHA1:	48309FF2CB3F229473D753FFE29A2AA5DC370726
SHA-256:	D7720C1A5546F0AB937C21A380DBE2521CF388B6C6175F1CEF997332BD53C536
SHA-512:	19AFE04FAB45F70A7D6A36A8D16C5EEF6AE5B0D6A8A60F3BE37199F5A2767C0E813C08EFEBA181BC4FD0D6073156385B846955060F8C8A6D79066A18BF246C45
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cf8c304c2d0e45b0a24587ea13c9d379.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81629tOBfOM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.324972876917407
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoGgBnQHIuRNEWh+s9:SbFuFyLVIg1BG+f+MoVBQHIgEWZjoa
MD5:	36B09019AB76BBEA07F83337FAD662EE
SHA1:	2A1CD555EB608D5FE9F66AC23C6D95AE851340CD
SHA-256:	208B2E9B77B283D5812D15C03AA6951E54389D81BC35822A8AAD673A77944615
SHA-512:	7EE9A62863364016D50BA82DE202E8CA05CC582BD4ED183427DEABB2C762D8D1279647756F95FF7E45570E5C08CA4A113C48024C0011E437A7D1AD8AAF98AAC4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bcbeda5e165b4bfd96a68e6a1b7fbad0.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:816725rGezQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.359487003783956
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvlEGpYUKS39Xlgrxm:SbFuFyLVIg1BG+f+M7KqX6rqjtWL0
MD5:	3C24C7D752B5C858AC8D151F09C748F8
SHA1:	AC338F131949D439BE4B356305E8A1C5C579F3C7
SHA-256:	1059C19D64030A706DC2C0D2E7AE18BB99AE2962653857DBB33AB353DDDD16A9
SHA-512:	B0F83E940CBCAE2CCC55212207C87E294C5BFAE96903CACDA57FC38A89DC2A579EEE891B9B32B5B5824E919F6E4D594E7A5BDA573E9F27D9CFDFF3508E9B1EA8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ecc1e2d3fc4d4206a971f37d39f0b82a.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:81787CS8pEN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.447962210340552
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9SXdMGYquxsjsjOdy:SbFuFyLVIg1BG+f+MYu9PqjNE
MD5:	28304E13E1067F2AA4F72DFD8EF12ACC
SHA1:	3FABAF82F7FA4AC1FCE0F7612AF006CC549D54B2
SHA-256:	4026A48CC4D241C51E937F6B878F3C9A3A4077C9B2EE92497691FF8F8FF3AC1C
SHA-512:	C50968BF39A06667A2B7059601C763C04B2F88C9AE1C41FFBAD345F59CB68A53DF3914888AB0D4804AFF7958C7B4DF9ED2E1A1034007C0F3CD93901E8C5E2ABA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=78527cc9c29d47ca95ecf7ab33606013.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:82675gtRRWR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3922082540808365
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6rEBRbVX68jswkClK:SbFuFyLVIg1BG+f+M6QbVX68jLkGq
MD5:	AF3CBAE807A00E6C39EF840AC83B775C
SHA1:	6B599FC027C9670F626C883E6671B692D13CB9DA
SHA-256:	5AABDD678BFDB99FDDD5AE0AF74FF20CBF015EA97CC82B29738036670D89E5D4
SHA-512:	BC4A3183AD5DD7E39FFF08C1FFC7F8AA83BBF30347CA7F302A46FF2942CD4E71ACE70F1BDB4CA4A7B9FDD92C86D1A09482C6C7BCEA254E6B01601505A7CA810B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=062846ac34214bbc932ed6ad5bc01035.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:82677TD9BeR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.507023874779691
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MldXzkQd5ZjZcHcljX+:qgFq6g10+f+MldQQjmAu
MD5:	AE6B0EC79BC55BE69E681CD6634D187E
SHA1:	FD72F12DD848B1508A02A4AE5F8EC85034DE57B3
SHA-256:	824ED5FFB2A678A84E9359B0659065AEF44FCB1A38000385589D72E1258A3BFF
SHA-512:	91AAD7B03854682CB32A23A96C3F28C8E169925C834C0E0FED72F32F4ABFFE08F931E2558C167083153F411BCB5E2B897BF1317A824E88DD35EF101EBB68F482
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ebf93b8f825946758f0f5a331b7ae8a2.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:82678zbFVCQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394564311371697
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/LTS10HWSWuR3J2je:SbFuFyLVIg1BG+f+Mg03DojdCLKzK
MD5:	37EDF6D7F54C9FED0788DF791AE251E1
SHA1:	09CDFF56A8342E5EE1A547274590D918B8331218
SHA-256:	CE691CD4F55A84A2F5E228340D97379E075092DDCB0F53A14D185974A88D3B18
SHA-512:	05989F712E2735D8CF0300B4E8C0E2F58430BB46E37BFFFF28DF18717A4EFCAA476577332FCADD1303A155CF448927B208B19133902EF00992875418E4E75186
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c96085b2a5645c3b4b35b39eac14e7f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:82679tirKAQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.374140660710357
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmre1RI4PBSXvsMxsjt:SbFuFyLVIg1BG+f+MybIlX0jtWL0
MD5:	03154A6B6B8D862F4BDB6419224E5D43
SHA1:	FB14BCC48B99E5470F17EDF1C47A9C26BA2A17E6
SHA-256:	5B12E2E22A2B9D3F6F6D3839B274F85632FF234D8E703AC0793E3B61EB50A2C8
SHA-512:	8F216A1FE35BC0E16B916306F1435DDEF6C4852E4193DB54237D6DC4758BF9DEB48949B0906673A8F94B3359D0498489CC042B169AF5E72EBA5CEC47455E0101
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a32e8cd5679a454f8cecf565446f2472.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:82697anUHaS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.445586411400758
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzrfWu0QUPNSHSBgr2:SbFuFyLVIg1BG+f+M3fBwSHSsqjosQu
MD5:	4437A420ABD41966EC65013C3D01DD72
SHA1:	D5117779934A8D5EA26D404420B812B02189D191
SHA-256:	398317B031C854E9BCD6F98D0A060893491C8A49D9BDAC4CA5E6A1FE8860DA76
SHA-512:	B88858F5FB407641070DFD0475A14E72A6E37BC5B069ED5ED268A127EE5118C2E4E3ACDD9CDDAA4B410D39457ECC3AB450E1ACEA3CBCE35C3464AE9B3DEC6183
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9248e30d4cfd472a86983f48d9fe7b75.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:82704eF6GxS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.458104009346771
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzYh2sEXDwVQWWvsw5:SbFuFyLVIg1BG+f+M8nEUxZjNE
MD5:	DADD2E03C304C024BE11665F724AEF9B
SHA1:	14E52515C251A8ABC1F8B7AE7D1D4E6F8363F1CE
SHA-256:	3353CF2E3C385BB00CE8E766C6D13D0992238EEA1980C7CB2F4493FA1C847681
SHA-512:	A5731B4BC3D5794ED8A7ECDEDA7C75FD57C083E2374B6FD8FA47B33D35CC44E4289DF06FFC54952638DD8FBCB8B8AAB74EBFB88BA0255D637546DAA5F24AEBD7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=91f6c9fc549b4ce3a2dcb59d087e3853.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:827058CC9BQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.394714381894728
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoET2pelGWsjshKJv4:SbFuFyLVIg1BG+f+MoiGrjbVC
MD5:	64F3DC041738E4C301A46675483B09F1
SHA1:	28C1E05D7DE8775BD4355671D087F2B4982D525B
SHA-256:	826C874640EF2B65E1F0A347F02E0BD0B6D2F66FC46FC2531173D6D3D9D6BE97
SHA-512:	679D26E4E8EB76FD9E68F19F1213151018A3111CD8A342175DF9CCF3B5ADF5658F61FEEFE550DED4CF056A6383729D5E8E0C72B5704F9DEE2D5BA0549FCDDE1E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba5c36ff2d814606a9ac62205bacddab.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:82713koOpZR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4578281505365185
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4gkmdOQBN2js2ALAXaN:SbFuFyLVIg1BAf+M4gk1ON2jNALyAZD
MD5:	4418AFF50E80A1A1F371569763C5DDF0
SHA1:	FCD34CFB513C5EC7FFADD3EC46545090AC210D4A
SHA-256:	1A5D6D1CCDB75E6B81AE02C4E2B97256EBCCCC37D50495C7A1848C614E6B3268
SHA-512:	9C9770D8A639018D8DA5213221483040C4E176194D9B8634D6E885B89072A3A639CF7BB41741B5F0E60E70A258C71633EBAEE9D8E1174D94275805BA206B1E7F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=24c359a967644ef0b89ac83a7587d409.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:82714FacH0O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.38730577769705
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvlgH0cGrcEEt2lsj+:SbFuFyLVIg1BG+f+MUrGrcEEtZjLkGq
MD5:	3E9B6336536B272E5453626969ABCD8D
SHA1:	7DB3F09FEE6FAE8C23A748D110A752E5530B042F
SHA-256:	7A0270A66DAC13CE5CDDA215DC1E96D106BA73C4167A28AABB04FD8A09D1E332
SHA-512:	F7621285A90356728A02F19ABE63BD96A62A4358FF7EDB17918302BA5DBFE9AC99CBF7894E14F1F33070C8B76920A4C1A661644AC9BF02B3BCFE89B9A57F0E66
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e09a42f83b504fecbc946ad6113a32aa.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:827152eKrDP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3758175355123115
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyXQqzActto+sjs1Ha:SbFuFyLVIg1BG+f+MyXBUq2joa
MD5:	AF6F86C343687A40B852F004C221C7F5
SHA1:	C85C004D1D4A3A23D7A392479A0A3B0760AEBB07
SHA-256:	6C9B925DDF540421BEC81F832504D3AF6C92DE3CC9D5C31768D3E98362CA9B7A
SHA-512:	6F6347EC6E92F418DD646A7993E98C414186DE300DA8B7C98A44B855FE07DAC473CCD9B0B04E213030DF580040C6215C7C0D5896EE5BC2979C6B24C70441F6C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8e14877af0e84f68b62593e46880fa32.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:82716yNHvcR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.457245961489764
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mm123FcKm8jNdQIeXD:qgFq6g1af+M9WKD2D
MD5:	5543B5AD67055A9078D75D6C4E62512E
SHA1:	2E2F85FB3D4EC329403DD5246078B5082670F2FC
SHA-256:	962D2D42ECD86F87F91BA5B584E5486B1AA9E166285B00A8ECDE5F8FE61B5155
SHA-512:	0CA5EF1D63CD0D21695B2048D25A97E13B1EDDE0AC7C78E2FB3577BE78009BFEBC84ED5D41684269F5E229C3F9A5AA6BD34F238BE05DF6A8B7A02326FA11CC80
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=730b46de2d3744c79476413b226d0962.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:82813fT9BTR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.419997625437839
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8IwXBD5gNkSsqjNTZD:qgFq6g1af+M8XX15EHTZD
MD5:	BDF65DBB017F5162F1A86C2CF874C51A
SHA1:	36D42C4E6CD650F5EE9C3AF9A080D650802DBC8E
SHA-256:	4D1B942BCAB456C5D8AC6416B4F5B0A1973887482751AF031E9118625EADACAE
SHA-512:	9B142CE228FF6451EEC85A3B7CE1BE1AA9F409E7CC189C7A895AC3053D864A5560AE2482933B8D1709E4949E836A52999E7A675F07EE1493EF7B840DC6B4863E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=658dc2c3fa594986a8181a67d41cb489.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:82818SgHL0Q

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.41464500372806
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvvDcGXLuEMMxsjswq:SbFuFyLVIg1BG+f+MgGXajjLTTIWTIL
MD5:	B358383544C143ACBE439F6D87F97CA1
SHA1:	2497908F5692340BFCABC1DAFBD73027434979A7
SHA-256:	1AEE8AB53F84ADF65F936B9F8140FD73ECB0356B5046D43B0504E51236C4B622
SHA-512:	72C6E91537B86B174E61B24000F77F533D5D2AEDC44C62BB63EA2EB8CE64C760C9940B4B50071798EF153CEC2C7B6FA89455CC340570EC9482C2BE9F861DFB9E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e798d9102d2440559f8831a3884088c0.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:82854axACSP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.441316770582665
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsBRtGnREU4v8jsz:SbFuFyLVK6g7/+BG+f+MsBHWf40jNq
MD5:	C58655884DCE5E88AF9FA5FC98BB4D1B
SHA1:	E1F7F0051CD73A9B502ACE07E171F56360082A2E
SHA-256:	914C2552FD33924CE2C4377290955CDEB08FF898E89A8B56A90260E6B0B91538
SHA-512:	71EEFB75BE11C12903190075CFD96C66A891E0911B43908B664838EE57201AE09ECED0B982F4D3DEC9318C8DAF3E22A73FC8C923AFA82444DD46AD4F091CB79C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fd4d2798d48c4d438257223b4168fa07.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82855EYcCrR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.360838163226922
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmvG2RFsjs2BDfAXv:SbFuFyLVI6g7/+BG+f+M+LjNq
MD5:	CB64B3F29F1D397838675F4941E44CA7
SHA1:	EB81B0EB403D8FBA73C7A7DD96743397307E3435
SHA-256:	F753B17C63C1D69AC6A33D204D7F269DEE91CA7AEA1DD5904EC19D0A73611F13
SHA-512:	4A0DA1E5E3C6A03894F233198D1A7445F27CF82C7CA39C3710613F52BB5E66A64FE06C39D3A5BA516201366D147726FA228DF78F91F0166DD1EC4B6BB62BA00D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ecb62406dea04c46988acd604f2638ca.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:82889exBSuO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.417879466987667
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9fHBzjURHRHfqjsis:SbFuFyLVIg1BG+f+MtBzcMjZcHBrt
MD5:	26A7307A91A96CD19E444D7B8F12EDD1
SHA1:	AFFBD99A83077FDA06553059B17BC64F98FC3816
SHA-256:	A9D45652B8D011F0D6191FBDE9FA40D3B89C57304E42EAFAA8D3200BBAEDC55D
SHA-512:	3D3D67C7C092E9359A96DAA5ABD9A8C10C3C34F60794AF0BBFDAD5987AEEC2ADF4CF7CBCF491B99E4DB352982BA7EF388EE2307B31C5FD3B7187BDA467CA8912
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7ffbdfad7751468f84bc2caf24d4d4af.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:82891riQGrR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.476923313380009
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MD0gVGhdEpjFQMzKaBu:qgFqo6g7/+0+f+MD0QGhW/Tmh
MD5:	3EA6FFD12CC18F552180B3D52178061E
SHA1:	2313F65C7E051A17E9476253860060ACBD5A69D9
SHA-256:	24F249089915D50BB035FAB064774B8F70DB0812281C7508E5AACCD98A528B00
SHA-512:	7493ADB30BC76B7589C72C6D310701047E3C985FCC5630AC50C4D0587DAC1BAEA5A860BB4C3E7A6B2F35C3E276020A2F132F7A680A12833010E5B334C15D0D83
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e488e9ab947e4b68a85ec910cea8566e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:82894EnrUcR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.557480173265178
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+htqjFQMzKaBu:qgFqdg7/+0+f+Mqt4Tmh
MD5:	939A0269F9B37966284D23018192A9CC
SHA1:	FCDFB911DD0BDF86CF2FB9225B8EAF157FF64A9C
SHA-256:	828EFC8BD186B8E689D452B614A5634EF1986C773BE57C2CDC24A54D13A8287B
SHA-512:	3EDB54DEF30FB0072995874041FC2A858FF110A2AB0E2966CA8F0659DC8CFF7E4D139D1ADB5D5E6B037A0DCC33E8F78A87EB6583FE46C1B1F90C79D906F28FB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=48f66778364f4289aee81123c53c5d6c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:84009fQnm5O

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.373244693108678
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6zmDd8+nXseEJshgR:SbFuFyLVIg1BG+f+M66BxXBE6jZcHjv
MD5:	C6759B3D97C51CD83BEEDCBFF316B2A0
SHA1:	C341D19B8F66E5F9872E455DDFE04C5E376CC9A3
SHA-256:	F654C805C24B0F6947C59D90DB94D0742A1F8885E7C3EC223D5076DE470C0258
SHA-512:	8EC204760E586A0336C71F18B12BEB6A6A4EB14872F3E22B61F1627F2BF2A1D2CE5B1999928D93E07A3B8E5020BCEE0AA2E0DB96E3BA68469AA6C508F0EB9BC7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=02539c35380b4e808ef86417620c67a4.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:84012In34zS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.361648556744417
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8QgA0cGenTrFvXsjt:SbFuFyLVIg1BG+f+M8QgA0cG4HF0jtWQ
MD5:	2B34119C056802BFC558FB542CF24FB1
SHA1:	3945932B62AFA78DE6C891D0CB4245901042DDB0
SHA-256:	391D563335CEC4B29E36A752C87B363A1FF519B288872A8E42C04452045EC555
SHA-512:	C541A635382EDEF7877CC0DF482DCE07BF3D28DA3AECA9F5A5FE7A5393F547417E79AA0E360D664A4449F99C55E39B5FEAEACEB4676B3CB96F9245815C83E77F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=632d3c8827d649c4890e92f8f9a82d8b.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:84063fkXepR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.362113353153672
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/UX+QHAyRHAZR0js4:SbFuFyLVIg1BG+f+MC+QgyhDjoa
MD5:	8F68118EA9966D205E7999D0783151B9
SHA1:	51A919AFE37B2506C4B89D468B1483E77F1C1B34
SHA-256:	AB1772252C3947733ABC878608A77E646FA8410F7947DECC4163CD9BB388C59F
SHA-512:	6CE0F5F9EB87C429AE84F4125DC33A35166AE18930B654345EA41BE8DC55E2264C3E5A488BD77EB3CAEF20B4C6F616EF9000C0DFA1E5CF26946857CC4B858B24
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ca28ccb9de1448db987be7d4b3d21e4.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat02CnwBu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat02zlXTU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0A7gTkT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0axNuU8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0fHPagu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0kZ59t8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0wmQxvh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1274LW6Et

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.331803018140688
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgG6UdrvrqW14GW206qodpjbv:SbFuFyL3BVgdL87iesnAiRJg4I9t6LL
MD5:	D87EF261CFEF8A649811083D2FB02948
SHA1:	F45F34C717468C9CAD602DAB0681789036E66F95
SHA-256:	41737F9D7A528D850EBBE7941AF51766FCD31ECA514FEC1A286829E67A179FCD
SHA-512:	7D06E565B2858BEEB0B2121C66A452731736525330574FC9BE3722BFA4C4CC5ED14F53EE648D90CEAB6620C8BF7C9CFFFF2FDE1249222788AED6AA36906BA4FC
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733339164543402.MONOTONIC=527503694.LAST_SESSION_TIMESTAMP=527576803.

/run/systemd/users/.#127AlZ8a8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.478531685759653
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8+gpyv1ivtgt6a:qgFq30dABibBE+gEMvWIa
MD5:	2A90698CF02D2E97FBA1BD9FF89F8D64
SHA1:	25B8CA9CBAE52ED99C39171EC4022211E58292B4
SHA-256:	D0135CAD103C51527DBF0B686B4EAC8329D2EB58EE8D672D9D7143BE093D5F0F
SHA-512:	6C319730594B8C373E1605A56541D87913BB5DB479383F5B22BEECD60C0FBF7EA1B3EA58840E21C3AE04166DE1A270F8E60B30144E93C50090BB700E9778B48E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14748.REALTIME=1733339224765304.MONOTONIC=587725596.LAST_SESSION_TIMESTAMP=587831237.

/run/systemd/users/.#127DwlMv7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3253229068390135
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8vJgpyv1iv2g202thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBERgEMvWPthQHtPYqi
MD5:	108BE4B771ADF7D1879CBD47CE21C7CF
SHA1:	23AFEC4CCCF51410455F8C0204DEB51C7DB2D32A
SHA-256:	60C700C632A1115A18D7F3104F129C9E0B0A77F791873C87826B4B91729DC1B4
SHA-512:	4775F2FBF8E5CCF642DA60A73E62902DDE61A848DF548857F30975B55141AE3A645B07B418D97350AB7F0CD0A471EE8162000C748751E618D7049B3261253D0B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14686.REALTIME=1733339224765304.MONOTONIC=587725596.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127KgzY7u

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.495469719272998
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixffyg4I9t6LL:qgFq30dABibBqg4EI/
MD5:	D2C6586FAA336E9A157EFDD0B9884C4A
SHA1:	794942984FAD52B6FA7F523D13CA551F44514D64
SHA-256:	58311E41669E228E9264F9C3F14D479037D3EE2185F920619E3CFE54ABBEF161
SHA-512:	A93AF869807A5D9FEFEB3D6E457D0DA69C6F3716404D9CB2F9AD12DB3EE062A07FDEF588F0606551245EC271524908DA46A9CAA1D0C86E994503563503B93A1F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13829.REALTIME=1733339164543402.MONOTONIC=527503694.LAST_SESSION_TIMESTAMP=527576803.

/run/systemd/users/.#127LmOSq9

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.478531685759653
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8+gpyv1ivtgt6a:qgFq30dABibBE+gEMvWIa
MD5:	2A90698CF02D2E97FBA1BD9FF89F8D64
SHA1:	25B8CA9CBAE52ED99C39171EC4022211E58292B4
SHA-256:	D0135CAD103C51527DBF0B686B4EAC8329D2EB58EE8D672D9D7143BE093D5F0F
SHA-512:	6C319730594B8C373E1605A56541D87913BB5DB479383F5B22BEECD60C0FBF7EA1B3EA58840E21C3AE04166DE1A270F8E60B30144E93C50090BB700E9778B48E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14748.REALTIME=1733339224765304.MONOTONIC=587725596.LAST_SESSION_TIMESTAMP=587831237.

/run/systemd/users/.#127Mrse9s

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.495469719272998
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixffyg4I9t6LL:qgFq30dABibBqg4EI/
MD5:	D2C6586FAA336E9A157EFDD0B9884C4A
SHA1:	794942984FAD52B6FA7F523D13CA551F44514D64
SHA-256:	58311E41669E228E9264F9C3F14D479037D3EE2185F920619E3CFE54ABBEF161
SHA-512:	A93AF869807A5D9FEFEB3D6E457D0DA69C6F3716404D9CB2F9AD12DB3EE062A07FDEF588F0606551245EC271524908DA46A9CAA1D0C86E994503563503B93A1F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13829.REALTIME=1733339164543402.MONOTONIC=527503694.LAST_SESSION_TIMESTAMP=527576803.

/run/systemd/users/.#127Oh8Xhx

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Tfg0V7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Uz9EdS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295379263822795
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6Hzg1p+yEvHRf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUzgTFthQHtPYq9M
MD5:	3617A6DE371CB3CCF09E9376B202AB41
SHA1:	0409044DBAAC6EB5217DC431286A9C6C18838ED2
SHA-256:	EF53A21E53996D6E63685DA22A02B6301BFDFD06AF4D8BFDB292D84FC2298193
SHA-512:	4D281A85A5641FB5D1E08D8D8824109AB2912B3B25FA4207727188ED42CFEDBA577D60EF99735E6057030D11F38A54C06E3A4FCAE24751666BF8C80E8FD5107A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12411.REALTIME=1733339121125075.MONOTONIC=484085368.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Y6eG56

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3253229068390135
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8vJgpyv1iv2g202thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBERgEMvWPthQHtPYqi
MD5:	108BE4B771ADF7D1879CBD47CE21C7CF
SHA1:	23AFEC4CCCF51410455F8C0204DEB51C7DB2D32A
SHA-256:	60C700C632A1115A18D7F3104F129C9E0B0A77F791873C87826B4B91729DC1B4
SHA-512:	4775F2FBF8E5CCF642DA60A73E62902DDE61A848DF548857F30975B55141AE3A645B07B418D97350AB7F0CD0A471EE8162000C748751E618D7049B3261253D0B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14686.REALTIME=1733339224765304.MONOTONIC=587725596.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127eQTae7

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3151559092197695
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgG6XBSn7wQK4/nivp/g206qodI:SbFuFyL3BVgdL87iesnAiRJgpyv1ivtS
MD5:	AE1E6F7D7DF95128564811EAD22796B6
SHA1:	F0741FC631065881958F53402B0608D5137FEC20
SHA-256:	EA5E097B7B7259119603DD88AEF21838E91C802DFC765A2117FA2E0B335B9FC1
SHA-512:	A1A77BB0B3C7D2B54A8026F4D6076C8F6764B777794709C1BB84194CDFDD176F6B66A72564398615FC0E867A118EA0173D6D7E4E85A2BF0201A2BFFCDD7FB2C1
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733339224765304.MONOTONIC=587725596.LAST_SESSION_TIMESTAMP=587831237.

/run/systemd/users/.#127emm9Qt

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.300718506370197
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffT5Jg4IS2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBb5Jg4SthQHtPYq9M
MD5:	0D857DE003D64D20F11BEA09191D5296
SHA1:	EF0719736D8751A0BAF05D2ECD656664ACC36F34
SHA-256:	0E75B626ECE9A575C3A34CC453B37E3C89CCE12FD300E02639B28296D2E280E3
SHA-512:	0FAF1F503FD2598801BC446C8893556122B1677FB1BB5C114F8373E0DBC6D2CDF7CC0A3918A2EAF0C4C076D9F0894C1B6A46E8EE2A9467254B01E7DE82E9BAB6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13767.REALTIME=1733339164543402.MONOTONIC=527503694.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127f15RQS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127vsjqNV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.341868247591912
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgG6UEU2+x4dEvp/xi206qodkAj:SbFuFyL3BVgdL87iesnAiRJg1p+yEvpL
MD5:	D8F62A0C4568E39019CB4B85BB0532B2
SHA1:	AAA51C81360AE0BC262C3235E5C255191E73AC01
SHA-256:	E78FC36A42AC7056CF15917F1BFE29CA34D47E6590E6BDFE7309BDFEE965C95C
SHA-512:	1B862CAF338F0112D21F3724973F85CDF146A553AE2C65E1012CEE58C9ED797F738291DFA2406388B04003BBEB673D39CCBF478ABAB1C87CCA66DC5F3D257D7F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733339121125075.MONOTONIC=484085368.LAST_SESSION_TIMESTAMP=484176506.

/run/systemd/users/.#127yajm8u

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.300718506370197
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffT5Jg4IS2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBb5Jg4SthQHtPYq9M
MD5:	0D857DE003D64D20F11BEA09191D5296
SHA1:	EF0719736D8751A0BAF05D2ECD656664ACC36F34
SHA-256:	0E75B626ECE9A575C3A34CC453B37E3C89CCE12FD300E02639B28296D2E280E3
SHA-512:	0FAF1F503FD2598801BC446C8893556122B1677FB1BB5C114F8373E0DBC6D2CDF7CC0A3918A2EAF0C4C076D9F0894C1B6A46E8EE2A9467254B01E7DE82E9BAB6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13767.REALTIME=1733339164543402.MONOTONIC=527503694.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ylvvkW

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295379263822795
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6Hzg1p+yEvHRf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBUzgTFthQHtPYq9M
MD5:	3617A6DE371CB3CCF09E9376B202AB41
SHA1:	0409044DBAAC6EB5217DC431286A9C6C18838ED2
SHA-256:	EF53A21E53996D6E63685DA22A02B6301BFDFD06AF4D8BFDB292D84FC2298193
SHA-512:	4D281A85A5641FB5D1E08D8D8824109AB2912B3B25FA4207727188ED42CFEDBA577D60EF99735E6057030D11F38A54C06E3A4FCAE24751666BF8C80E8FD5107A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12411.REALTIME=1733339121125075.MONOTONIC=484085368.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mR/:mp
MD5:	3FAD43A31E251BA43CEA2E3D3B7001C7
SHA1:	A912FB37B9DE276B83BD756B920471011EC7F045
SHA-256:	6E62E4EBAE1BE12AA33BBC4EF96E713D8790DB9869D0262A2DA8041DAB0A062D
SHA-512:	0BB8CA2CE6FE8197568E77BC956DE3E29620C202B82108940009300D00A2E2EFBD642BAE3896AE57C7C3DFFB085EA0276CE41A1F2EA1F51A768E700FFD9AD1E2
Malicious:	false
Preview:	7042.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nGvn:4
MD5:	6489C1E07CD0133458B5F9EE1D9BAC05
SHA1:	1BBE10FB346E960456D388392AAD3C7F4FD325AA
SHA-256:	075D1FEA8444B281D25948B4D74B1A8A51B1A8AEEE5F5AB50432A33A26204FEE
SHA-512:	42E258FB1374DC08AC042A715E93CCA30396D57B92F97AF908F178029266DBE71FE879BB915788627B25AB567B420587C1EA7D87128AE071239F44583855D1B2
Malicious:	false
Preview:	7123.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:CCsXlXEWtl/ils:4+ylKq
MD5:	6699A5F415E0B558EA25E48261A65D2F
SHA1:	C30BCC61AF69863D70B97EFAEC4DA7E74E8552AC
SHA-256:	A0740FD7838DEA26AEB371E6D6CFE3D545A818E83621EA79F6C4CC026B28A97A
SHA-512:	E7DB02E7B7EC22FFB3D197EE126D285F66107C3E61420A4CC9098CF8B88880FAFC3A2A61A396483360F5CDDACCFA2E966E0D72237631B6040F7A10EFF2EEA4D6
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................I.Pg........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nNvn:Nvn
MD5:	14C356C96C13DF15711FCADA4DBC8C70
SHA1:	E36578D700355B1119539AE552CB5AE8FC928213
SHA-256:	8C41174039C652813729FD1BA987D1E03E544EE9E4D956A046EDAC778F58345C
SHA-512:	5A10698BC578C38E0B1E2FA253D823C484277D6A5107F197CAC717E23F3D4B4197D296C78DC849FAC959F163E92797864F7333807DFD53F3DF850FE955D63EE3
Malicious:	false
Preview:	7128.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nHvn:Hvn
MD5:	E024B1A39C9FF63B0E61BEF169414842
SHA1:	E9B27AA52782DA82687FD16F10BC46426D8D0046
SHA-256:	3E4344C295A3D90D97F464BDF991008A2B8210B66DE905FF4A6422A8571A3224
SHA-512:	D09EFCED2344B99CE9D28193229F55EB1A89523D5F6494D026F3653D15F46A9DC0CE87B7ED6E4407C4C8B2A68068F5033E6AD33893C23FB11946883A1D598BF3
Malicious:	false
Preview:	7122.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:n6hv:I
MD5:	D3A526C37EE7F6B66F6EFE4B46739E00
SHA1:	8230D60E81420F5CFC907DCE894719B579E58636
SHA-256:	DB17200D1AAC39579982F3E039D8A4EB2FE70FDC83A0C0141214680BDA201408
SHA-512:	2283DC9129D010940C839529D08D2287C3A9ED87878268783358020D6DA7F775228B0B36816091CF5FDE0A7860A5FC0FE920E693FF67F65B590C50611A146DBE
Malicious:	false
Preview:	7105.7106.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nGvn:4
MD5:	6489C1E07CD0133458B5F9EE1D9BAC05
SHA1:	1BBE10FB346E960456D388392AAD3C7F4FD325AA
SHA-256:	075D1FEA8444B281D25948B4D74B1A8A51B1A8AEEE5F5AB50432A33A26204FEE
SHA-512:	42E258FB1374DC08AC042A715E93CCA30396D57B92F97AF908F178029266DBE71FE879BB915788627B25AB567B420587C1EA7D87128AE071239F44583855D1B2
Malicious:	false
Preview:	7123.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nNvn:Nvn
MD5:	14C356C96C13DF15711FCADA4DBC8C70
SHA1:	E36578D700355B1119539AE552CB5AE8FC928213
SHA-256:	8C41174039C652813729FD1BA987D1E03E544EE9E4D956A046EDAC778F58345C
SHA-512:	5A10698BC578C38E0B1E2FA253D823C484277D6A5107F197CAC717E23F3D4B4197D296C78DC849FAC959F163E92797864F7333807DFD53F3DF850FE955D63EE3
Malicious:	false
Preview:	7128.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nHvn:Hvn
MD5:	E024B1A39C9FF63B0E61BEF169414842
SHA1:	E9B27AA52782DA82687FD16F10BC46426D8D0046
SHA-256:	3E4344C295A3D90D97F464BDF991008A2B8210B66DE905FF4A6422A8571A3224
SHA-512:	D09EFCED2344B99CE9D28193229F55EB1A89523D5F6494D026F3653D15F46A9DC0CE87B7ED6E4407C4C8B2A68068F5033E6AD33893C23FB11946883A1D598BF3
Malicious:	false
Preview:	7122.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:n6hv:I
MD5:	D3A526C37EE7F6B66F6EFE4B46739E00
SHA1:	8230D60E81420F5CFC907DCE894719B579E58636
SHA-256:	DB17200D1AAC39579982F3E039D8A4EB2FE70FDC83A0C0141214680BDA201408
SHA-512:	2283DC9129D010940C839529D08D2287C3A9ED87878268783358020D6DA7F775228B0B36816091CF5FDE0A7860A5FC0FE920E693FF67F65B590C50611A146DBE
Malicious:	false
Preview:	7105.7106.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nGvn:4
MD5:	6489C1E07CD0133458B5F9EE1D9BAC05
SHA1:	1BBE10FB346E960456D388392AAD3C7F4FD325AA
SHA-256:	075D1FEA8444B281D25948B4D74B1A8A51B1A8AEEE5F5AB50432A33A26204FEE
SHA-512:	42E258FB1374DC08AC042A715E93CCA30396D57B92F97AF908F178029266DBE71FE879BB915788627B25AB567B420587C1EA7D87128AE071239F44583855D1B2
Malicious:	false
Preview:	7123.

/var/lib/AccountsService/users/gdm.GCVHY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.QV2DY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.ZDJNY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.9253537679080335
Encrypted:	false
SSDEEP:	24:y1IZeamgGmIWJN7Av+7A2+VEKI0pYryRJrwWirCQU:y19shjEv+EfVEKnYrSr2rCn
MD5:	860C17C000A48E24470487238C0B1C58
SHA1:	3B1FB25433568185CA534A6455C8435036D8DC09
SHA-256:	3E3D3EBEAB369C4D80BC093AE3157B5EDC92AE740758A882E2D51FBB9062EAAC
SHA-512:	4EAB2FB5FAF53D4BFA54E9B482D93AC9434AAC847259DE78BF651D69215A8F4E8C51486B3E41DAF916DE85ABC2DF6D8109CBB148A8842FDFF6F36A15061658D8
Malicious:	false
Preview:	Dec 4 13:06:52 galassia systemd-logind[6982]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 4 13:06:52 galassia systemd-logind[6982]: User enumeration failed: Invalid argument.Dec 4 13:06:52 galassia systemd-logind[6982]: User of session 2 not known..Dec 4 13:06:52 galassia systemd-logind[6982]: Session enumeration failed: No such file or directory.Dec 4 13:06:52 galassia systemd-logind[6982]: Watching system buttons on /dev/input/event0 (Power Button).Dec 4 13:06:52 galassia systemd-logind[6982]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 4 13:06:52 galassia systemd-logind[6982]: New seat seat0..Dec 4 13:07:04 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 4 13:07:04 galassia systemd-logind[6982]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Dec 4 13:07:04 galassia systemd: pam_unix(systemd-user:session):

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlMKniOKnG:F310
MD5:	22406EE2909641C96CAD2CCD2E8F2F1E
SHA1:	D574D4441A8166E631B9057A69A36F01ED768725
SHA-256:	4FC2DD519B28F7CB6BB0B8CA166380CF335596BE59BAF3A09B95ADD3D6C1C7EC
SHA-512:	64BD67224365B970F4B1AD79EA08DA2F09E26AF92C3B0674B6F4A84333D3B0A79A8E66911E3B67B636A04B888132913EE9693647A158EC31FBE101E557C42A9B
Malicious:	false
Preview:	LPKSHHRH................$@.!\.B.0....._................................$@.!\.B.0....._........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlYcwFdtvcwFdtg/l:F3IcwFvvcwFvgt
MD5:	3BD65D25ECDE902EB04EBDDE1719F5E2
SHA1:	F3F7F75F29E30C44BDC87FAD1103BF0FEB61916D
SHA-256:	521F0D4452CA0B55C0412BDD968587BB3440075F0CE34901BC3D4A5F24F22F84
SHA-512:	3430BE4C5433D19D3EEBF0A6AC7AE21471CF15EBEEF6E7B30618476A381ADB1E6ED89B8E31A78FFC5B3F53EC67E0AE205321DC5F83D15267C68384300E25962F
Malicious:	false
Preview:	LPKSHHRH.................X....G5.D.c/...................................X....G5.D.c/..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12269
Entropy (8bit):	4.924177968704328
Encrypted:	false
SSDEEP:	192:f3KspepzLPcY253AeAB4Ifr8etUCLEhEzdrcT89:ClLPX253AeAB9MeT
MD5:	6FD7650AAFE7DDA03C9E98A122CEE8B3
SHA1:	49DDCA8473316AA80B04ECD84CC379CECE11D7B6
SHA-256:	46DA6E958CE77FF5E557D727EE393EEB00022D15B26DD7DF16A2517B0B9AE813
SHA-512:	BC22AF82F4CAAD55012E69EECEF9560F9A6A5198346CB3873C27F9FB97FF215A488B3A55E40E84361A19DA22761827681F4EBEFCE2F98A3CE84B2FFF0DDB4905
Malicious:	false
Preview:	Dec 4 13:06:44 galassia kernel: [ 560.060535] blocking signal 9: 6271 -> 2048.Dec 4 13:06:44 galassia kernel: [ 566.327568] blocking signal 9: 6271 -> 658.Dec 4 13:06:44 galassia kernel: [ 566.334944] blocking signal 9: 6271 -> 720.Dec 4 13:06:44 galassia kernel: [ 566.342641] blocking signal 9: 6271 -> 772.Dec 4 13:06:44 galassia kernel: [ 566.353024] blocking signal 9: 6271 -> 936.Dec 4 13:06:44 galassia kernel: [ 566.360109] blocking signal 9: 6271 -> 2048.Dec 4 13:06:44 galassia kernel: [ 567.127561] New task spawned: old: (tgid 7023, tid 7023), new (tgid: 7023, tid: 7043).Dec 4 13:06:44 galassia kernel: [ 567.321289] New task spawned: old: (tgid 7041, tid 7041), new (tgid: 7041, tid: 7045).Dec 4 13:06:44 galassia kernel: [ 567.322460] New task spawned: old: (tgid 7041, tid 7041), new (tgid: 7041, tid: 7046).Dec 4 13:06:44 galassia kernel: [ 567.327098] New task spawned: old: (tgid 7041, tid 7045), new (tgid: 7041, tid: 7047).Dec 4 13:06:44 galassia kernel: [

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	32235
Entropy (8bit):	5.080048053303832
Encrypted:	false
SSDEEP:	768:F5jjItLNT3VRT3V+XP7Wv3TxI6G0F+253AexVxBxXxLABNrdrHQMX1RHRTgEymMf:F5Pi9+253AeXjB5ABNrdrHQMJw
MD5:	24FCEFC4C9F5A2685EDBD524B4C73DBC
SHA1:	46AE4A1B9CA5054F7E77373FF664BDDF7187A6A7
SHA-256:	C62E5F7196D33CF08378960142AC350FC0A5C02DED24A5F044F8974A91960283
SHA-512:	8DC0F3F362A3C81F47FE3130A6B1936165A26A36DD8E7E8EF5DC50B937CF87E22B77A15012B29D235112E5CC8157F00542CBDBC5FD197E3ED9B2AC25CD47A7FA
Malicious:	false
Preview:	Dec 4 13:06:43 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 4 13:06:43 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 4 13:06:44 galassia kernel: [ 560.060535] blocking signal 9: 6271 -> 2048.Dec 4 13:06:44 galassia kernel: [ 566.269781] systemd[1]: rsyslog.service: Scheduled restart job, restart counter is at 5..Dec 4 13:06:44 galassia kernel: [ 566.269796] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 4 13:06:44 galassia kernel: [ 566.269810] systemd[1]: Stopped Journal Service..Dec 4 13:06:44 galassia kernel: [ 566.271091] systemd[1]: Starting Journal Service....Dec 4 13:06:44 galassia kernel: [ 566.271134] systemd[1]: Stopped System Logging Service..Dec 4 13:06:44 galassia kernel: [ 566.272146] systemd[1]: Starting System Logging Service....Dec 4 13:06:44 galassia kernel: [ 566.275113] systemd[1]: polkit.service: Succeeded..Dec 4 13:06:44 galassia kern

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6722951801018083
Encrypted:	false
SSDEEP:	3:CCsXlXEWtl/ils:4+ylKq
MD5:	6699A5F415E0B558EA25E48261A65D2F
SHA1:	C30BCC61AF69863D70B97EFAEC4DA7E74E8552AC
SHA-256:	A0740FD7838DEA26AEB371E6D6CFE3D545A818E83621EA79F6C4CC026B28A97A
SHA-512:	E7DB02E7B7EC22FFB3D197EE126D285F66107C3E61420A4CC9098CF8B88880FAFC3A2A61A396483360F5CDDACCFA2E966E0D72237631B6040F7A10EFF2EEA4D6
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................I.Pg........................................

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:52674 -> 178.215.238.4:33966

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.415501827018844
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	dwhdbg.elf
File size:	172'264 bytes
MD5:	9d9b06ad1c145757a00b353a4efc8e26
SHA1:	1d8d16d5c3c7a81673a0cf9e554a56a0b9d46fc2
SHA256:	13dd4fa6a557a32c7c47553c50bb84427747ae3d2844ff29b9de98ad3aa80ec0
SHA512:	2b56d075b4317f122c9ab5e5c8d727814b71ce0aa663ea7d2e561c0cac2b28a80d71cd57758dd3307c94e50945290ad36cff8df604c7f22bf53436633ad91fae
SSDEEP:	3072:kpg03bw4agXbZ/iF1uZqEXGrqHINBzZUXSrxAq8qC/Cd04qe8PmFVD:kpg03bw4aQbZ/iFnEXGrFUIR7W4ND
TLSH:	4AF36C07B5C0C4FDC4CAC0744BAEA637E932F19D1238B25B27D4EA222E4DE315B5DA95
File Content Preview:	.ELF..............>.......@.....@.......h...........@.8...@.......................@.......@...............................................R.......R.....(.......@...............Q.td....................................................H...._........H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	171624
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x1c2c6	0x0	0x6	AX	16
.fini	PROGBITS	0x41c3c6	0x1c3c6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x41c3e0	0x1c3e0	0x44c0	0x0	0x2	A	32
.ctors	PROGBITS	0x521000	0x21000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x521018	0x21018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x521040	0x21040	0x8de8	0x0	0x3	WA	32
.bss	NOBITS	0x529e40	0x29e28	0x7100	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x29e28	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x208a0	0x208a0	6.3945	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x21000	0x521000	0x521000	0x8e28	0xff40	0.2384	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 4, 2024 20:04:12.117471933 CET	34905	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:12.485331059 CET	53	34905	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:12.486430883 CET	33076	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:12.725698948 CET	53	33076	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:14.114989042 CET	57565	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:14.260572910 CET	53	57565	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:14.284986019 CET	43202	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:14.426702976 CET	53	43202	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:15.817373991 CET	41984	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:15.954220057 CET	53	41984	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:15.955739021 CET	52913	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:16.467645884 CET	53	52913	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:34.540940046 CET	50775	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:34.680532932 CET	53	50775	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:34.681837082 CET	55386	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:34.817428112 CET	53	55386	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:36.205751896 CET	55082	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:36.455342054 CET	53	55082	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:36.456584930 CET	41820	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:36.582837105 CET	53	41820	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:37.982625961 CET	43924	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:38.118100882 CET	53	43924	8.8.8.8	192.168.2.23
Dec 4, 2024 20:04:38.119766951 CET	47189	53	192.168.2.23	8.8.8.8
Dec 4, 2024 20:04:38.242542028 CET	53	47189	8.8.8.8	192.168.2.23
Dec 4, 2024 20:05:02.005099058 CET	41465	53	192.168.2.23	1.1.1.1
Dec 4, 2024 20:05:02.005183935 CET	47838	53	192.168.2.23	1.1.1.1
Dec 4, 2024 20:05:02.157919884 CET	53	47838	1.1.1.1	192.168.2.23
Dec 4, 2024 20:05:02.248686075 CET	53	41465	1.1.1.1	192.168.2.23
Dec 4, 2024 20:05:02.663638115 CET	44120	53	192.168.2.23	1.1.1.1
Dec 4, 2024 20:05:02.905729055 CET	53	44120	1.1.1.1	192.168.2.23
Dec 4, 2024 20:05:26.561338902 CET	55003	53	192.168.2.23	1.1.1.1
Dec 4, 2024 20:05:26.702673912 CET	53	55003	1.1.1.1	192.168.2.23
Dec 4, 2024 20:05:43.300806046 CET	57566	53	192.168.2.23	1.1.1.1
Dec 4, 2024 20:05:43.443713903 CET	53	57566	1.1.1.1	192.168.2.23
Dec 4, 2024 20:06:47.448575974 CET	51799	53	192.168.2.23	1.1.1.1
Dec 4, 2024 20:06:47.448633909 CET	35373	53	192.168.2.23	1.1.1.1
Dec 4, 2024 20:06:47.598208904 CET	53	35373	1.1.1.1	192.168.2.23
Dec 4, 2024 20:06:47.598901987 CET	53	51799	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 4, 2024 20:05:02.562367916 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 4, 2024 20:06:22.575994968 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-04 19:05:06 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-04 19:05:07 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-04 19:05:07 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-04 19:05:08 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Wed, 04 Dec 2024 19:05:08 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	19:04:10
Start date (UTC):	04/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	19:04:11
Start date (UTC):	04/12/2024
Path:	/tmp/dwhdbg.elf
Arguments:	/tmp/dwhdbg.elf
File size:	172264 bytes
MD5 hash:	9d9b06ad1c145757a00b353a4efc8e26

Start time (UTC):	19:04:13
Start date (UTC):	04/12/2024
Path:	/tmp/dwhdbg.elf
Arguments:	-
File size:	172264 bytes
MD5 hash:	9d9b06ad1c145757a00b353a4efc8e26

Start time (UTC):	19:05:43
Start date (UTC):	04/12/2024
Path:	/tmp/dwhdbg.elf
Arguments:	-
File size:	172264 bytes
MD5 hash:	9d9b06ad1c145757a00b353a4efc8e26

Start time (UTC):	19:05:44
Start date (UTC):	04/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	19:04:12
Start date (UTC):	04/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	19:04:54
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:04:56
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:04:59
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:05:00
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:05:01
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:05:02
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report dwhdbg.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6643/oom_score_adj

/proc/6948/oom_score_adj

/proc/7117/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:76031kdFfJg

/run/systemd/journal/streams/.#9:76032w51X6e

/run/systemd/journal/streams/.#9:76193Z13aXf

/run/systemd/journal/streams/.#9:76302AQwdof

/run/systemd/journal/streams/.#9:76307ZHvYZh

/run/systemd/journal/streams/.#9:765968MRHWh

/run/systemd/journal/streams/.#9:7660567kd3f

/run/systemd/journal/streams/.#9:76719Znjbyh

/run/systemd/journal/streams/.#9:76790yQ3aSh

/run/systemd/journal/streams/.#9:77883Htcozi

/run/systemd/journal/streams/.#9:77944ByjnOf

/run/systemd/journal/streams/.#9:7802656RfUg

/run/systemd/journal/streams/.#9:78176WEEApf

/run/systemd/journal/streams/.#9:78188l0rZyf

/run/systemd/journal/streams/.#9:78218Ae4u6g

/run/systemd/journal/streams/.#9:78220MAFwXg

/run/systemd/journal/streams/.#9:7824858Nd5g

/run/systemd/journal/streams/.#9:78249kPgf2h

Linux Analysis Report
dwhdbg.elf

Start time (UTC):	19:05:03
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:05:04
Start date (UTC):	04/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	19:05:05
Start date (UTC):	04/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:05:06
Start date (UTC):	04/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	19:05:08
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:05:18
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:05:19
Start date (UTC):	04/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	19:05:21
Start date (UTC):	04/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	19:05:22
Start date (UTC):	04/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	19:05:24
Start date (UTC):	04/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75