Edit tour

Linux Analysis Report
iwir64.elf

Overview

General Information

Sample name:	iwir64.elf
Analysis ID:	1570451
MD5:	f4d0efeac26a54fc80b89808192df4ef
SHA1:	319ff7c3b4ca42095c1f8e0699257e470c15dd07
SHA256:	987197793b510546ae71404e1b94368d82ff874c643f3430508429187e764218
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1570451
Start date and time:	2024-12-07 03:37:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	iwir64.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/150@53/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/iwir64.elf
PID:	6216
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

iwir64.elf (PID: 6216, Parent: 6135, MD5: f4d0efeac26a54fc80b89808192df4ef) Arguments: /tmp/iwir64.elf

iwir64.elf New Fork (PID: 6217, Parent: 6216)

iwir64.elf New Fork (PID: 6218, Parent: 6217)

iwir64.elf New Fork (PID: 6379, Parent: 6218)

sh (PID: 6379, Parent: 6218, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6380, Parent: 6379)

ps (PID: 6380, Parent: 6379, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

iwir64.elf New Fork (PID: 6877, Parent: 6218)

sh (PID: 6877, Parent: 6218, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6878, Parent: 6877)

ps (PID: 6878, Parent: 6877, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6219, Parent: 1477)

sh (PID: 6219, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6219, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6224, Parent: 1)

systemd-hostnamed (PID: 6224, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6343, Parent: 1320)

Default (PID: 6343, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6376, Parent: 1320)

Default (PID: 6376, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6437, Parent: 1)

journalctl (PID: 6437, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6455, Parent: 1)

systemd-journald (PID: 6455, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6459, Parent: 1)

journalctl (PID: 6459, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

gdm3 New Fork (PID: 6473, Parent: 1320)

Default (PID: 6473, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6475, Parent: 1860)

pulseaudio (PID: 6475, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6478, Parent: 1)

dbus-daemon (PID: 6478, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6480, Parent: 1)

rsyslogd (PID: 6480, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6485, Parent: 1)

rtkit-daemon (PID: 6485, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6488, Parent: 1)

systemd-logind (PID: 6488, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6550, Parent: 1)

polkitd (PID: 6550, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6554, Parent: 1)

gpu-manager (PID: 6554, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6555, Parent: 6554)

sh (PID: 6555, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6557, Parent: 6555)

grep (PID: 6557, Parent: 6555, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6559, Parent: 6554)

sh (PID: 6559, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6560, Parent: 6559)

grep (PID: 6560, Parent: 6559, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6561, Parent: 6554)

sh (PID: 6561, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6562, Parent: 6561)

grep (PID: 6562, Parent: 6561, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6563, Parent: 6554)

sh (PID: 6563, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6564, Parent: 6563)

grep (PID: 6564, Parent: 6563, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6565, Parent: 6554)

sh (PID: 6565, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6566, Parent: 6565)

grep (PID: 6566, Parent: 6565, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6567, Parent: 6554)

sh (PID: 6567, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6568, Parent: 6567)

grep (PID: 6568, Parent: 6567, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6569, Parent: 6554)

sh (PID: 6569, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6570, Parent: 6569)

grep (PID: 6570, Parent: 6569, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6571, Parent: 6554)

sh (PID: 6571, Parent: 6554, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6572, Parent: 6571)

grep (PID: 6572, Parent: 6571, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6556, Parent: 1)

agetty (PID: 6556, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gvfsd-fuse New Fork (PID: 6576, Parent: 2038)

fusermount (PID: 6576, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6581, Parent: 1)

generate-config (PID: 6581, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6582, Parent: 6581)

pkill (PID: 6582, Parent: 6581, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6583, Parent: 1)

gdm-wait-for-drm (PID: 6583, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6589, Parent: 1)

gdm3 (PID: 6589, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6592, Parent: 6589)

plymouth (PID: 6592, Parent: 6589, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6602, Parent: 6589)

gdm-session-worker (PID: 6602, Parent: 6589, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6608, Parent: 6602)

gdm-wayland-session (PID: 6608, Parent: 6602, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm3 New Fork (PID: 6610, Parent: 6589)

Default (PID: 6610, Parent: 6589, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6611, Parent: 6589)

Default (PID: 6611, Parent: 6589, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6593, Parent: 1)

accounts-daemon (PID: 6593, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6597, Parent: 6593)

language-validate (PID: 6597, Parent: 6593, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6598, Parent: 6597)

language-options (PID: 6598, Parent: 6597, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6599, Parent: 6598)

sh (PID: 6599, Parent: 6598, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6600, Parent: 6599)

locale (PID: 6600, Parent: 6599, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6601, Parent: 6599)

grep (PID: 6601, Parent: 6599, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6612, Parent: 1)

agetty (PID: 6612, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6613, Parent: 1)

rsyslogd (PID: 6613, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6617, Parent: 1)

dbus-daemon (PID: 6617, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6622, Parent: 1)

gpu-manager (PID: 6622, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6623, Parent: 6622)

sh (PID: 6623, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6624, Parent: 6623)

grep (PID: 6624, Parent: 6623, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6626, Parent: 6622)

sh (PID: 6626, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6627, Parent: 6626)

grep (PID: 6627, Parent: 6626, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6628, Parent: 6622)

sh (PID: 6628, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6629, Parent: 6628)

grep (PID: 6629, Parent: 6628, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6690, Parent: 6622)

sh (PID: 6690, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6691, Parent: 6690)

grep (PID: 6691, Parent: 6690, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6693, Parent: 6622)

sh (PID: 6693, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6694, Parent: 6693)

grep (PID: 6694, Parent: 6693, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6695, Parent: 6622)

sh (PID: 6695, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6696, Parent: 6695)

grep (PID: 6696, Parent: 6695, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6697, Parent: 6622)

sh (PID: 6697, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6698, Parent: 6697)

grep (PID: 6698, Parent: 6697, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6699, Parent: 6622)

sh (PID: 6699, Parent: 6622, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6700, Parent: 6699)

grep (PID: 6700, Parent: 6699, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6633, Parent: 1)

systemd-logind (PID: 6633, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6703, Parent: 1)

generate-config (PID: 6703, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6704, Parent: 6703)

pkill (PID: 6704, Parent: 6703, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6705, Parent: 1)

gdm-wait-for-drm (PID: 6705, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6709, Parent: 1)

rsyslogd (PID: 6709, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6710, Parent: 1)

dbus-daemon (PID: 6710, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6716, Parent: 1)

rsyslogd (PID: 6716, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6717, Parent: 1)

dbus-daemon (PID: 6717, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6725, Parent: 1)

systemd-logind (PID: 6725, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6784, Parent: 1)

journalctl (PID: 6784, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6785, Parent: 1)

systemd-journald (PID: 6785, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6788, Parent: 1)

rsyslogd (PID: 6788, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6789, Parent: 1)

dbus-daemon (PID: 6789, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6792, Parent: 1)

systemd-logind (PID: 6792, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6849, Parent: 1)

systemd-journald (PID: 6849, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6850, Parent: 1)

agetty (PID: 6850, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6851, Parent: 1)

gpu-manager (PID: 6851, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6857, Parent: 6851)

sh (PID: 6857, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6858, Parent: 6857)

grep (PID: 6858, Parent: 6857, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6859, Parent: 6851)

sh (PID: 6859, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6860, Parent: 6859)

grep (PID: 6860, Parent: 6859, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6861, Parent: 6851)

sh (PID: 6861, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6862, Parent: 6861)

grep (PID: 6862, Parent: 6861, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6864, Parent: 6851)

sh (PID: 6864, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6865, Parent: 6864)

grep (PID: 6865, Parent: 6864, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6867, Parent: 6851)

sh (PID: 6867, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6868, Parent: 6867)

grep (PID: 6868, Parent: 6867, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6869, Parent: 6851)

sh (PID: 6869, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6871, Parent: 6869)

grep (PID: 6871, Parent: 6869, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6875, Parent: 6851)

sh (PID: 6875, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6876, Parent: 6875)

grep (PID: 6876, Parent: 6875, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6879, Parent: 6851)

sh (PID: 6879, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6880, Parent: 6879)

grep (PID: 6880, Parent: 6879, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6881, Parent: 1)

generate-config (PID: 6881, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6882, Parent: 6881)

pkill (PID: 6882, Parent: 6881, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6883, Parent: 1)

gdm-wait-for-drm (PID: 6883, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6890, Parent: 1)

gdm3 (PID: 6890, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6893, Parent: 6890)

plymouth (PID: 6893, Parent: 6890, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6907, Parent: 6890)

gdm-session-worker (PID: 6907, Parent: 6890, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6911, Parent: 6907)

gdm-wayland-session (PID: 6911, Parent: 6907, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6913, Parent: 6911)

dbus-daemon (PID: 6913, Parent: 6911, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6915, Parent: 6913)

dbus-daemon New Fork (PID: 6916, Parent: 6915)

false (PID: 6916, Parent: 6915, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6917, Parent: 6911)

dbus-run-session (PID: 6917, Parent: 6911, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6918, Parent: 6917)

dbus-daemon (PID: 6918, Parent: 6917, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6921, Parent: 6890)

Default (PID: 6921, Parent: 6890, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6922, Parent: 6890)

Default (PID: 6922, Parent: 6890, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6894, Parent: 1)

accounts-daemon (PID: 6894, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6898, Parent: 6894)

language-validate (PID: 6898, Parent: 6894, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6899, Parent: 6898)

language-options (PID: 6899, Parent: 6898, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6900, Parent: 6899)

sh (PID: 6900, Parent: 6899, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6901, Parent: 6900)

locale (PID: 6901, Parent: 6900, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6902, Parent: 6900)

grep (PID: 6902, Parent: 6900, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6903, Parent: 1)

polkitd (PID: 6903, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6935, Parent: 1)

systemd-journald (PID: 6935, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6938, Parent: 1)

agetty (PID: 6938, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6939, Parent: 1)

systemd-logind (PID: 6939, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6962, Parent: 1)

rsyslogd (PID: 6962, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7001, Parent: 1)

dbus-daemon (PID: 7001, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7002, Parent: 1)

gpu-manager (PID: 7002, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7006, Parent: 7002)

sh (PID: 7006, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7007, Parent: 7006)

grep (PID: 7007, Parent: 7006, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7010, Parent: 7002)

sh (PID: 7010, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7011, Parent: 7010)

grep (PID: 7011, Parent: 7010, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7013, Parent: 7002)

sh (PID: 7013, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7014, Parent: 7013)

grep (PID: 7014, Parent: 7013, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7015, Parent: 7002)

sh (PID: 7015, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7016, Parent: 7015)

grep (PID: 7016, Parent: 7015, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7017, Parent: 7002)

sh (PID: 7017, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7018, Parent: 7017)

grep (PID: 7018, Parent: 7017, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7021, Parent: 7002)

sh (PID: 7021, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7022, Parent: 7021)

grep (PID: 7022, Parent: 7021, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7031, Parent: 7002)

sh (PID: 7031, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7032, Parent: 7031)

grep (PID: 7032, Parent: 7031, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7033, Parent: 7002)

sh (PID: 7033, Parent: 7002, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7034, Parent: 7033)

grep (PID: 7034, Parent: 7033, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7009, Parent: 1860)

dbus-daemon (PID: 7009, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7012, Parent: 1860)

pulseaudio (PID: 7012, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7020, Parent: 1)

rtkit-daemon (PID: 7020, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7026, Parent: 1)

polkitd (PID: 7026, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7037, Parent: 1)

generate-config (PID: 7037, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7038, Parent: 7037)

pkill (PID: 7038, Parent: 7037, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7043, Parent: 1)

gdm-wait-for-drm (PID: 7043, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7048, Parent: 1)

gdm3 (PID: 7048, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7051, Parent: 7048)

plymouth (PID: 7051, Parent: 7048, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7061, Parent: 7048)

gdm-session-worker (PID: 7061, Parent: 7048, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7069, Parent: 7061)

gdm-wayland-session (PID: 7069, Parent: 7061, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7071, Parent: 7069)

dbus-daemon (PID: 7071, Parent: 7069, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7075, Parent: 7071)

dbus-daemon New Fork (PID: 7076, Parent: 7075)

false (PID: 7076, Parent: 7075, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7077, Parent: 7069)

dbus-run-session (PID: 7077, Parent: 7069, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7078, Parent: 7077)

dbus-daemon (PID: 7078, Parent: 7077, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7080, Parent: 7048)

Default (PID: 7080, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7081, Parent: 7048)

Default (PID: 7081, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7052, Parent: 1)

accounts-daemon (PID: 7052, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7056, Parent: 7052)

language-validate (PID: 7056, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7057, Parent: 7056)

language-options (PID: 7057, Parent: 7056, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7058, Parent: 7057)

sh (PID: 7058, Parent: 7057, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7059, Parent: 7058)

locale (PID: 7059, Parent: 7058, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7060, Parent: 7058)

grep (PID: 7060, Parent: 7058, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7067, Parent: 1)

systemd (PID: 7067, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7072, Parent: 7067)

systemd New Fork (PID: 7073, Parent: 7072)

30-systemd-environment-d-generator (PID: 7073, Parent: 7072, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7084, Parent: 7067)

systemctl (PID: 7084, Parent: 7067, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7085, Parent: 7067)

pulseaudio (PID: 7085, Parent: 7067, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
iwir64.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
iwir64.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1c320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c35c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c44c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c49c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
iwir64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x11fdc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
iwir64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x12853:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
iwir64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe706:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe8f8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
iwir64.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x165ba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
iwir64.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1b406:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
iwir64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12413:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
iwir64.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11312:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
iwir64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x126de:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
iwir64.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1150b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
iwir64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
iwir64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
iwir64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6d42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6216.1.0000000000400000.0000000000420000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1c320:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c334:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c348:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c35c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c370:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c384:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c398:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c3fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c410:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c424:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c438:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c44c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c460:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c474:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c488:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c49c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1c4b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x11fdc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x12853:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe706:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe8f8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x165ba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1b406:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12413:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11312:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x126de:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1150b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6216.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6d42:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: iwir64.elf PID: 6216	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: iwir64.elf PID: 6216	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x119c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x11ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1200:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1214:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1228:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x123c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1250:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1264:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1278:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x128c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12a0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12b4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x12f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1304:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1318:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x132c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6480)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6613)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6709)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6716)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6788)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6962)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6455)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6589)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6785)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6849)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6890)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6913)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6935)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7048)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7071)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7067)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.179.dr, syslog.43.dr, syslog.191.dr, syslog.123.dr, syslog.173.dr, syslog.284.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 38358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38358
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: iwir64.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4449, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4470, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4480, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4501, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6045, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6164, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6357, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6358, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6359, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6379, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6380, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6475, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6478, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6556, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6589, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6612, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6617, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6708, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6708, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6710, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6455, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6705, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6711, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6712, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6716, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6717, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6786, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6787, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6408, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6788, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6789, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6849, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6850, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6856, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6877, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6878, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6890, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4449, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4470, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4480, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 4501, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6045, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6157, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6164, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6357, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6358, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6359, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6379, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6380, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6475, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6478, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6556, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6589, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6612, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6617, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6708, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6708, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6710, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6455, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6705, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6711, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6712, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6716, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6717, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6785, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6786, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6787, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6408, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6788, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6789, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6849, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6850, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6856, result: successful	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6877, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6878, result: no such process	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6218)	SIGKILL sent: pid: 6890, result: successful	Jump to behavior

Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: iwir64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: iwir64.elf PID: 6216, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/150@53/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6478)	File: /proc/6478/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6576)	File: /proc/6576/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6617)	File: /proc/6617/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6710)	File: /proc/6710/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6717)	File: /proc/6717/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6789)	File: /proc/6789/mounts
Source: /usr/bin/dbus-daemon (PID: 6913)	File: /proc/6913/mounts
Source: /usr/bin/dbus-daemon (PID: 7001)	File: /proc/7001/mounts
Source: /usr/bin/dbus-daemon (PID: 7009)	File: /proc/7009/mounts
Source: /usr/bin/dbus-daemon (PID: 7071)	File: /proc/7071/mounts
Source: /usr/bin/dbus-daemon (PID: 7078)	File: /proc/7078/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6219)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6219)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6224)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:7616112MpZh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76163R0Tash	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76304FuzLkg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:7630598BE8g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76314evKNzg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76490dLtiKk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76491E4gAMj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76608tuzmcg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76703uylfPi	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76760SI2sLj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76761GAh5xk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76766RBK5lg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76775EPxfqg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:76797F4DPcj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:78861iGgKqk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:78862dp6MHj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:78883tF4Pyj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:7888432oXtk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:78972r21UEj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79080ds6slg	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79153N0oh8j	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79167uqoKJj	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79208eiEZ2j	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79228Cb0zFh	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79246KcM3Mk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79258P4JWvk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79346uTsw8g	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79468pi6Vok	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File: /run/systemd/journal/streams/.#9:79553Z3RI0h	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	File: /run/systemd/seats/.#seat0ELYtHL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	File: /run/systemd/users/.#127N8YFyN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	File: /run/systemd/users/.#127XI2jVO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	File: /run/systemd/seats/.#seat04zcF8K	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	File: /run/systemd/users/.#127BwqO6O	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6488)	File: /run/systemd/users/.#127mhF47M	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6550)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6593)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6593)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6633)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6633)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6633)	File: /run/systemd/seats/.#seat0vdBCzK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6792)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/seats/.#seat0XooAiO
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#127NrLSYK
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#127lNvtcM
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/seats/.#seat0Dy34LK
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#1271xl30N
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#1271nCXKN
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#127UrVulN
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80948IJyvU3
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80955BGQOX4
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80956eklX23
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80968udWMj6
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80969bv4pK5
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80970eWk4V7
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:809783biNX7
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:809791P5l76
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:809880cIJ76
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:81010FDAIS4
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:810214BWtZ3
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:81044HKjGZ3
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:81045tCR1A5
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:81065zPLeW5
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:81066tqQFM3
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6911)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6903)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2296257zBjIUB
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2334585do60AB
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2334586N8EljA
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2334595HcrnAB
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2334602XIbwrz
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2334603L5A54A
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2334610HU9anB
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:2334611oUNblz
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:233462002pGJB
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:241971798hLVB
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:3373681mC5pXB
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:4886065IyTcVA
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:5330628BRVTxA
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:5332291NC2f2B
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:5788447On3N2A
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:5788453XSAkyy
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:5788455cSPbHy
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:5788631e11BEz
Source: /lib/systemd/systemd-journald (PID: 6935)	File: /run/systemd/journal/streams/.#9:721511171t9jA
Source: /lib/systemd/systemd-logind (PID: 6939)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6939)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/seats/.#seat0eKOyYR
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/users/.#127G75U4R
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/users/.#127mwPipS
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/seats/.#seat0DbOmGR
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/users/.#127sDa2EV
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/users/.#1277lDVKR
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/users/.#127VEw9LR
Source: /lib/systemd/systemd-logind (PID: 6939)	File: /run/systemd/users/.#1278fv0ZR
Source: /usr/lib/policykit-1/polkitd (PID: 7026)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7069)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7052)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7052)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7073)	Directory: <invalid fd (4)>/.config

Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7001/status
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7001/attr/current
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7012/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7012/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7012/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7067/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7026/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7048/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7069/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7061/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7061/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7020/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7052/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7085/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/7085/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/6939/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/6997/cmdline
Source: /usr/bin/dbus-daemon (PID: 7001)	File opened: /proc/6997/cmdline
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7084/comm
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7084/cgroup
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7072/comm
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7085/stat
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7085/cgroup
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7085/comm
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/environ
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/sched
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/comm
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6593/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6485/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6550/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6475/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6475/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6475/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6478/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6478/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6488/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6589/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6602/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6478)	File opened: /proc/6602/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6593/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6593/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6593/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6593/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6593/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6593/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6593/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6474/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6550/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6550/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6550/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6550/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6550/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6550/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6550/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6475/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6475/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6475/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6475/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6475/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6475/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6475/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	File opened: /proc/6478/cgroup	Jump to behavior

Source: /tmp/iwir64.elf (PID: 6379)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/iwir64.elf (PID: 6877)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6555)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6559)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6561)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6563)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6565)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6567)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6569)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6571)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6599)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6623)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6626)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6628)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6690)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6693)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6695)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6697)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6699)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6857)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6859)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6861)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6864)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6867)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6869)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6875)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6879)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6900)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7006)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7010)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7013)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7015)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7017)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7021)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7031)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7033)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7058)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6557)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6560)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6562)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6564)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6566)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6568)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6570)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6572)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6601)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6624)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6627)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6629)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6691)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6694)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6696)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6698)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6700)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6858)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6860)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6862)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6865)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6868)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6876)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6880)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6902)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7007)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7011)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7014)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7016)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7018)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7022)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7032)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7034)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7060)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6582)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6704)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6882)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7038)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6380)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6878)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7084)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6380)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6878)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6785)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6849)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6935)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6556)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6612)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6850)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6938)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6589)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6589)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6593)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6593)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6890)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6890)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7048)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7048)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7052)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7052)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6480)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6480)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6554)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6613)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6613)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6622)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6709)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6716)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6788)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6788)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6851)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6962)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6962)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7002)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/iwir64.elf (PID: 6217)

File: /tmp/iwir64.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6554)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6622)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6851)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7002)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6380)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6878)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6475)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6582)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6704)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6882)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7012)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7038)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7085)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6224)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6455)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6475)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6480)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6554)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6602)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6612)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6613)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6622)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6709)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6716)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6785)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6788)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6849)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6850)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6851)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6907)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6935)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6938)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6962)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7002)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7012)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7061)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7085)	Queries kernel information via 'uname':

Source: kern.log.43.dr	Binary or memory string: Dec 6 20:39:00 galassia kernel: [ 475.386275] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.284.dr	Binary or memory string: Dec 6 20:40:46 galassia kernel: [ 580.720697] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.43.dr	Binary or memory string: Dec 6 20:39:00 galassia kernel: [ 475.386294] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.284.dr	Binary or memory string: Dec 6 20:40:46 galassia kernel: [ 580.720727] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6593)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7052)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: iwir64.elf, type: SAMPLE
Source: Yara match	File source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iwir64.elf PID: 6216, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: iwir64.elf, type: SAMPLE
Source: Yara match	File source: 6216.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: iwir64.elf PID: 6216, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
iwir64.elf	50%	ReversingLabs	Linux.Backdoor.Mirai
iwir64.elf	51%	Virustotal		Browse
iwir64.elf	100%	Avira	EXP/ELF.Mirai.Z.A
iwir64.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
raw.cardiacpure.ru	178.215.238.4	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.179.dr, syslog.43.dr, syslog.191.dr, syslog.123.dr, syslog.173.dr, syslog.284.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	na.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.25
	powerpc.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	i686.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	i586.elf	Get hash	malicious	Mirai, Gafgyt	Browse	162.213.35.25
	linux_amd64.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
raw.cardiacpure.ru	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	17334905466c073176eadfc4a4d1af620c5aa97d12d1156570ede93d276f9fa6d51fffb6c5778.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	45.88.88.7
	1733479268d0423578683b481c87d2b90a74213612e8837faf7f066c8e81ec92f9b2658c65965.dat-decoded.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	45.88.88.7
	17334178295ea73ab6cd4726fd542025ef7b7421cc440e3878f9b14a611f40e1dc873ff7cc498.dat-decoded.exe	Get hash	malicious	Njrat	Browse	45.88.88.7
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	rbot.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.sh4.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.arm5.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.powerpc.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.mipsel.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
CANONICAL-ASGB	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	91.189.91.42
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	185.125.190.26
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	bot.arm.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	91.189.91.42
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
INIT7CH	bot.sh4.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bot.arm.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse	109.202.202.202
	bot.arm6.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	bot.arm.elf	Get hash	malicious	Gafgyt, Mirai, Okiru	Browse	109.202.202.202
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6916/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/7076/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mRt:mr
MD5:	A915339249898363005E48005F4A5325
SHA1:	06B3636E74312D56F770C3FBA930D5842795D827
SHA-256:	34712D4CFEEC22DB6FD7A573ED15A4C1E13139B652D756618EE5B3358540D348
SHA-512:	5E50775A315C613C75F8C2C826912FAF17C80AC82B96522C4839E81A645DDEBD339C93028423914A57B37514B7481FDAC7A93EAF76D579255A43D4F8C28EAE11
Malicious:	false
Preview:	7048.

/run/systemd/journal/streams/.#9:2296257zBjIUB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.487521629073084
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrDGrSDiqjsicWmI2d:SbFuFyLVIg1BG+f+M+UiqjZcHcljX+
MD5:	854CDB6620441C9F079D07D33E27793A
SHA1:	263465AE8B53315F3D2D8D9E43733A606CF7AFCF
SHA-256:	B64DC0165976ED1FEF661AAF39BCA7CF74CDB109B43342F7E26D2DBA947C175E
SHA-512:	D6CD48180440FD066557DBE949B76B421E2DBE33C502F86A3CD4BA13D35396DFCCDAD913D8531B32B33481D3B14BC4771379ED8976C3140B4E24934AC351FAA7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac5e00981aa4461997821fc0bd2afb05.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:2334585do60AB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390733871553765
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/EES+WRXGk1XD4Zje:SbFuFyLVIg1BG+f+M8iWX718ZjdCLKzK
MD5:	703F302F84CC289D394AFEC1D9D086FC
SHA1:	68E326263D6921321806CCBB021F9ED5653C16FB
SHA-256:	869A046407425DF854C96A0882FCA2A4FB1D7E17F5807479EE048505F58BBC21
SHA-512:	321547C07CF4B549E277957E58E8E15BE5BB6587E40C8574C646A054ACF6B87A2212F7FA006F60FC99179E53B00DCE2538D51521670E54E7201585925CD40787
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=554a7bb266c342ca889ab5e2052131a7.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:2334586N8EljA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.398555795490084
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoPHHyLzD+2kTyvFlU:SbFuFyLVIg1BG+f+Mo/Sy29vF2josQu
MD5:	D6CA0F25C4CA17D7F7DBB758ABBA7ACC
SHA1:	C8C1E803D8F5FC7F27BBAA1EF565DF475B2F7DD9
SHA-256:	66475C68C792BF458FB45D64F0A905454AE520E973C5C8C35A706F99CE01A087
SHA-512:	FE74071D4DE8261039D537D055340FABA352D93F8965C7151C00FAC8E4513B703E2D6128ABD8FAADC8AF17AEBDBA9D66EA4BBB2988A0CC22EC45E800C11E9343
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6d8bb4a4b0d40f49440f85d7f2b6fb3.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:2334595HcrnAB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3806835912718025
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm45cTRUvyGjRFV3hgC:SbFuFyLVIg1BG+f+M4CdMywX3Zjoa
MD5:	FE7B6C50AACD15A5AD3C1FADF7E74B96
SHA1:	9534795AFEA3D399A5E68CDD272FA311AA561834
SHA-256:	C0FCB2227CA234AE9BD3347273634FED37502EA54EFD8EB02B41E33CDD6C9B0A
SHA-512:	80FC9ACAD959C16F0A38264F73E85E83D7AB60B7A1D3E67EA995AE7B53D2C8F365CAE458A503903ADDD8B688884753FBD021D26094F23311F0F610E67C6C3D23
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2546d9a59d8b414a8541c3054204c67e.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:2334602XIbwrz

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3621797560535125
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5dKJaWSKT3JF2jshQ:SbFuFyLVIg1BG+f+MEdSKDJF2jtWL0
MD5:	1A4404EECDF8A5A3F7203B8FF5AFEEBB
SHA1:	AB6437022EC5A6204B9A49B0F4C6C229FB894B49
SHA-256:	67D48895A01303AC305887B28288E2795DA57B5BA6FE8A687ECAB527D5584BCA
SHA-512:	B28A235C77359D51076E9FE1944336DC0F07607772DF1C18A23C118ECA9071FF1E4A5B97E542EA3EF6033B34CA506530B3072B6F1E47B099A76D594E67BDDF77
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=372193b476154653beb46c6eb1fa7d66.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:2334603L5A54A

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.392794863299377
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4DEEGGosEk1x2A+sO:SbFuFyLVIg1BG+f+M4DE2olkr28jNE
MD5:	938F7246FFB908AAE794BB2E3FF6ACA4
SHA1:	F808586F2EB8732BEAA132C1B8EDA9A938320EB5
SHA-256:	980D71E7EE8E20C0F55A25AF34757B86B4B698F1DBC5D91AB01E11778EC0EC9B
SHA-512:	C4BBE20418A72138327E2051C5143C8D57267B78727E20FEF7EE526D7841D57F9B099860790A7013399F1CADF80F342F60E836F986BDDF74F0F38E08E6816575
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2faa281cb3ce4a2a89800ad79a3f7021.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:2334610HU9anB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.392922811459317
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy/l8RXi12iBQklAuP:SbFuFyLVIg1BG+f+MydyUQmqjbVC
MD5:	DE640D629D72D03045FA1885D06201C9
SHA1:	9A1A5EF1246462A55A58F61BF022019701AA22BB
SHA-256:	FA5258FD53B961C4285C8BFFFE64EBC9007A449774761AA81EC7AE4F3198222D
SHA-512:	08B26A11CA6BE1049D527E3AEDF685FD9A11CA1484FB625BF972930F751761AC400F1CFC7A94B232FD8B2B2D613F62CBEB251E1249425D64287372FCEF08874A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8008dca2fda04274b5e5fe3474d590a9.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:2334611oUNblz

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.423410465217853
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9hTjRRmStAjDEGATS:SbFuFyLVIg1BG+f+MD2p/EG8jLkGq
MD5:	EF23CC8C08CEF1EDFB772BF769A188C0
SHA1:	E50A312A2B58FCB241530270254B62C5178BD0CE
SHA-256:	93EF13261C4EF67FD7105F22BA8E2D62EA1E9C11C8B3DB1439CA762FBE23BB93
SHA-512:	9C95F538A53DFB1D07A64C9E550AA8FA5EA401260520EF97C2FB57CE5038169EE29D75C93350009A3F4BCDCA21558F9C81A21FDF6B17AF325DF298131BFD8BC7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7bda72c852444437929d08b25a1dfa3f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:233462002pGJB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4120679578011055
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MoBn85K0Dz4jNALyAZD:qgFq6g1af+MoB8CIZD
MD5:	30B4F7CFE4D53383E89661250921DAA8
SHA1:	8CAC3069C2BD60BAB6F357F19BD677EE657DFE5E
SHA-256:	DF183667F16046DA2B7F503B4E90931B0A0AC26CBD5FA65912AB4AEF1BF199CC
SHA-512:	23688704FC8B7EDD5A4DF30D17935FFC56EF53BF526E33544050C6EE860299920ED3BAF107AB38AF4CFC309FCD328DF09DF081F10674486AE2C258DAB4156C4F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bd3154a4614d489a89fc6e0218fa1aaf.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:241971798hLVB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.465347885397567
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/FzDigSjUirxsjs2BbM:SbFuFyLVIg1BAf+MhSjUjNdQIeXD
MD5:	AB1DA4C0E0DC84A177867005603D713F
SHA1:	A2C21A39EC14A399DA5141B7D6B00594D47879E1
SHA-256:	FDDC20E37337C1FB4C9E17C65A8A6CB4D0BFD9B8D1CFF9FA6C93DA502B7CC283
SHA-512:	8E1759C2A99432A9F9853AC43585F929811343BF794F38AE1497C3F0C636D16F3CF4047301D1BAABDA8B1AAE0C0160012001F5F4BBCA713BD592E334CF04E706
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=55540f50b8ba4e7b955925660c7d0110.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:3373681mC5pXB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.415572577592432
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7DLHfPST5S1hTjs2BZd:SbFuFyLVIg1BAf+MLHSVSvjNTZD
MD5:	718500E50F981D1D9355357C8AF20AA7
SHA1:	F197ACA05E13B9FF1220184D301BF2DA1A7E7792
SHA-256:	BDBBBC931E509ED94953DAAB5933E1C0ED894B1BB3456B16E96981CF5651748E
SHA-512:	8F711DA5563E75453599B1B30A34298686CA14320E142659EA66378EF6791ACC86DAF27CA9E1869FD64EA1D9A61667DC329D151B002C4634FB2DD52B6DF48C0C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=18d734b5d5494f3a976e0872db717efd.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:4886065IyTcVA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.439202451990148
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MeLHgydnrjLTTIWTIL:qgFq6g10+f+MesyV/EWEL
MD5:	475F9EC629693B4FF3C0321FF755AA03
SHA1:	8D743124B94A069799B3DB100B950196947D14E8
SHA-256:	9F13AF798F42FB80BA6A8870A46BF41E81A3B8346AC9067D78B9F7367C28CBEA
SHA-512:	36167361C4D762468BAF7CDFB6A62A7E97EBD730276CDF39651926D4717ACA1D605D0B84938285CAB79CB48A1C079CFAE8D81ED083CA5AE8CC005FA4A4FB24B9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a90f78ade45b4dabb8861877457636a5.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:5330628BRVTxA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.429190986087278
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmpSxin+JWDOdKlsQ:SbFuFyLVK6g7/+BG+f+Mwxi5Kg2jNq
MD5:	367FF125A817373A28194E29D55D0529
SHA1:	3BC668CE4F609AB09CE5BD28D5D5213DE38DCBA2
SHA-256:	EBE3A7C83216336606D310EA5A40FBD9D3E562983B0D706C741CD3293BD1F365
SHA-512:	E2A3FF74021D1832DBD321ECC7BC4A8B88E927A67426D28291B5574AED488448FD3F2BDD74A22022EC0045E7B06EB0F346B5EFB3D81B15D613AEFED1716B2588
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8517ddfb0d14d8c8bc87353e797a681.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:5332291NC2f2B

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.419099652452307
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmu7ck7LTVvHOnjsz:SbFuFyLVI6g7/+BG+f+Mu7ck7L2jNq
MD5:	C527FBD29F2989C4B5BEB8BD34683257
SHA1:	54F025081F4D5091FC766D56B711F2D485CDAFFA
SHA-256:	8E4EE422131547F0D3488EE150C6E5E3FB4629C515A43724C4D467D3880BB5E4
SHA-512:	7BC1C02C524E8DDBA764742A9618C8CA077B5644AF40A079EE5690653026E730654146BBF8BDA54A5BEF86E00804B4A8E9FDBF163E8458DE6C7B17D19AA6EE51
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de69d7556d704c2eb68b2600fdb911b7.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:5788447On3N2A

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.443733998601551
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4G5HAirYg2jsicWm3:SbFuFyLVIg1BG+f+M4QAi8TjZcHBrt
MD5:	91296853745934CFDE057F4F80E36941
SHA1:	F93A8C80F71A4D67520ABE6639427D246007248C
SHA-256:	8B63974B3A7E8C3D767E5574AF72F25EF72C35FF245EA39FB7EDF696E8D7E258
SHA-512:	C5A2F8E27399E01F4C4DACCD5B0C8BBDA99847B12DF788B56BA757C04AB9D9363061792FE211E00A8276A76A3EC7AC2825204882D29DC2D37AB7AA16961E7C4A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c065e5fd5ee416cb9a7f3e584bbcb9f.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:5788453XSAkyy

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.537647806425271
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MZq6mjFQMzKaBu:qgFqo6g7/+0+f+MZp0Tmh
MD5:	16BB5E5183CF0D345828AEF340386D8D
SHA1:	D37770DD58827FEE52FFB229B5A8F0E2D20D3F64
SHA-256:	2523DDF3A70CF976A03A375F08AA07E099B061B2794D4BC44D9235677815084C
SHA-512:	27B95E501FEBEA143076650CE42037DDFD78B9815427680BBD5F88EFF6F16BBB144A3DB2E1325F67BD9304A19A3AF849F538E68E32F5A4C969B02CC519143C27
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b816f2727174d458d8fb6ee4ff98d92.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:5788455cSPbHy

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.51219553038743
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+PXOXDxojFQMzKaBu:qgFqdg7/+0+f+Mi0DkTmh
MD5:	1332CD520EAAB44655165C971D35690A
SHA1:	96FB8890D174A18CBF528DBC90E4CD834542B793
SHA-256:	C1CCD480D7BE6D558E9FE47E659609DC3183F839D609A903D3E5F785F1B4C4A6
SHA-512:	BDFBBA06E934B2306959D7E0A31762BF938BA2718D68EF1F823C8F4DCE4B671BA094E7D49403BF9FBB6FA4AA9F5A7CD18430E1787BE9BDA9128E10E0BEA352ED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4ebd9b1a0d724330843c96cff6038140.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:5788631e11BEz

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.326203348284455
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyb4pTdHkAfqjsicWI:SbFuFyLVIg1BG+f+Myb4p5HJSjZcHjv
MD5:	2593F58FFC906866EC08CB8B1176E426
SHA1:	C10ADAFBD2EE4325FFA509A1D30FFDFAFE78D7A2
SHA-256:	16DA2B2E5274F99702D1A004052D44B3348E32A4384BD730780292F2D27380F9
SHA-512:	75720A91AC7240991CFD883C37C90C73955A9ABB8B416B57873CAA2848C24AC4E49F4430BD29A6845F7D7D3CC653DE4AFD2919BF467988829F48A9AD6EE289B0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8eedd51a0f6641559cd93eae9133f686.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:721511171t9jA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.383456351798194
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5oe1R/JY9ow2lsjsO:SbFuFyLVIg1BG+f+MNYyojtWL0
MD5:	0522C3909F94D9C41BDACDDA982C5F38
SHA1:	3D2E5ABA309F0164F3AE4B79C880BFB5A97E0B1A
SHA-256:	84B76BCB3BAE00F2BC5531334AFECBBCF14EBF1D581A90201A018D3C20A3F00C
SHA-512:	597D56DC2E4BC614CDDF99AC521D71A9C7BC75C9FF78CDFE73596B8A631002E476507C82998743CB4FA8EBDD74C4C692F1AEF573B1D321663157A45CA83232C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38b789df4b3f47f0be56f78ac0212be3.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:7616112MpZh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.545182774418284
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7IWLFTy1bS2rATjsv:SbFuFyLVIg1BG+f+M8WLFES2r8ji4s
MD5:	4F3D4E700B0E4D880D70BD53570110A9
SHA1:	4F992DDAC23F9C7D42CC3A2A9EBF311531DC8394
SHA-256:	C73CD071F05CC4D33339AE78F867F820E107A03DC2CD39B01DCDEA7B858A7312
SHA-512:	B309C106E70CCD3F1CE8EC3EC0183D71DBE57876F3D657107720B9FA7253A2F8FAE8F07D2261DDE6F287CFF911CE09F93C216F745C22CF8F70021F960397FDB3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1ed41336bc76491c8466274152eb0217.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76163R0Tash

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.540234778688418
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4yLvxR7c0js7Lbgw3:SbFuFyLVIg1BG+f+M4699ji4s
MD5:	97754092BC19F319D94C7D5AE3C6D2B1
SHA1:	C0DEECB7F718A55D5F8814402FC0304DB481D14B
SHA-256:	5AFE4090DB8D26261DC115A35E05ADFB88BE044265EE097187D7EC90F1E51B92
SHA-512:	EC50B0A0C15C41FA92C4B325B9C55BE83CF977A4E51FE090A999D8C3815740698BDEB07AE721DD7A27AE522A0D43A2C3C62CB412B0F9F372AB1782B39ED3D08E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=217c0606693c4d54b22e1cb57f5aa999.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76304FuzLkg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.361425982382895
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm65BdU4VWGEBbsjshQ:SbFuFyLVIg1BG+f+M6fdoLIjtWL0
MD5:	10EE31EEB0C8EE6FE3B5D204F87B913C
SHA1:	5DEF287383C78CB5565CF9F7063B0AF90DF94154
SHA-256:	1B885557A240558F8DB0A14754198BE0829BF1C1D3AB13246CDB44CC1F9DD9E9
SHA-512:	DC2622D22F2A549D965F9232C7B313ABB7EAC3A8D14A7BBF58A6246DA414D73C220DCC34843B0F874D8F7A28FDC36F7A56B4808B58159EF8C3493FC41520AD5E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=08c5dbb644374418a403e6a5823fd943.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:7630598BE8g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.323315181234995
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+EPH0avYTjsmNz0L7:SbFuFyLVIg1BG+f+M+EP50jdCLKzK
MD5:	8892C303504E05723A24AB0E65234EC5
SHA1:	F4C1449F14B073CC8FC9F82C2326B24560230840
SHA-256:	E1E166F0756491A22FA815BA546AF6C655BF9EC30109333FCD8DA12943E887F1
SHA-512:	BEC69C2BCD17C898E502C27AD3FAFF67FB2EA271633F16A9EF5B32D5100F108FF12FD53C56365E9C4B72A236D86211408982964AA451B556691698E5DF55A396
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=404e8d9294ae404d851be4400ab18465.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76314evKNzg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.414715109344897
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8DdHFEBWcUIzTjs16:SbFuFyLVIg1BG+f+M8DdH+ZH3josQu
MD5:	927852923097588F97BF7FF85D66505C
SHA1:	2B4438A74D704F04BA157A0CF48B9A49787F7500
SHA-256:	4FE95CC11E0A7B33908EE4FBFE6516D78B29B6289DFF72BCEA60D67CD9CE6A6F
SHA-512:	6D05550C5E2D1C027852C72095764D9F5923141D45AA185A50A56B4AB28BB9D42E415FC2323788CA3F2B8B572CF796D4179F592093025E34EC0050DBD25E2538
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ff3c57ec1764ad3916e3493d3731fc5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76490dLtiKk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.434552039265368
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6hUUBo3hlYpv8jsjF:SbFuFyLVIg1BG+f+M6WUBo3fbjNE
MD5:	D164D85448C756A1DB382B1200783814
SHA1:	2637567D14C514B3B35AFF949AEC828E52F84864
SHA-256:	CAE35A2C2092013240AA87C39922D9500D5B811A5C013E127FD59EF2620416AE
SHA-512:	BCF6D8D11AF1AA2060F182A0B73964782D507E63D112F8E36FC6DDCF392395DA3D40B628E73BDA4EC6044C02ADF26771475BBD4A6014F79CF56BF9AA1A12D7B2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=007f7f5d360f478cadb224239d24f7ae.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76491E4gAMj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.445701813272913
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+wWHGi+jZcHcljX+:qgFq6g10+f+MPAGBmAu
MD5:	14352498314516476789A910D057F7F4
SHA1:	FDE28A9F17E0FA0F94F6FB0292D0012224AB7F62
SHA-256:	94E9BE43FF8CBF433715685780A0527FAEB17B712BB876C7149A94422D7A3BD7
SHA-512:	FC09C48FE08E8341B6191B084319C6B85340A35CF8F323896F621B700E3747751407C85B195EC736CEFA6E6CDC9C610FB7E2A68E5330CDC30D17BC17842152F8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=430a94249b1d452bbc427e9e04efa304.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76608tuzmcg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.372732735910939
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr2BmnBuwCINEY+sj0:SbFuFyLVIg1BG+f+MqBmEwTN1jbVC
MD5:	44EB339DB8B50B911BB1484A2B5CB2F6
SHA1:	20FE90765A837A5406F1F809F6B9B122B9EFDD63
SHA-256:	A73B26F5B6047EDB76CDA0A338FD41BF119B4E22A33895E0E1A6536A0735D58B
SHA-512:	8E2E022A1D2F7492CECCE681AB9547AFDCBBC0135D92435939BD684C50789951D56E59D5C2B384826A7FAB8E734936D42F349F022256800A1FF34B03651D133C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aded443b74ed4d2490d7de76d5c8628a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76703uylfPi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.444324191015387
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MeROA2tV4HvjNALyAZD:qgFq6g1af+MQefoIZD
MD5:	4F248558BA1AC707BFD67EB9C36EAF85
SHA1:	1A72E0EE6687667544A72A978D352542DF3583B7
SHA-256:	2432C0ED1FF78C36322939E4C699AE08AE513D3010EE62FBDAB5AE58D4A88810
SHA-512:	6095D97A21A9F7C21CBCBF0DB910BBB3798F261896F921F30C80099027377B96B01F025BE32868DCCCEC4279B8C3DAEBA488E224ABF52B75A0297C0A12766C72
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a0b75586119e45699f6048ae9107b21f.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76760SI2sLj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.443011186240235
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm63QHRQdGNRS6Auqjs2y:SbFuFyLVIg1BAf+M6gH3RFqjNdQIeXD
MD5:	A927102B6689A172C647027185F2393F
SHA1:	DD16A358E2852A00D7D7FE68BF7B55A502C89CFC
SHA-256:	06CA4D37E85D769AC92A66C3FEF3019D7C73F27EC6937AABFBCD1ECF4BE92EB0
SHA-512:	203DB8A0EA184BC2866FEDC1C8BF604B9824FC71AD2D1ADAB7421543007BA7E976A3078EC881755B4247E33B53603820DE68D1829B60FC6447025E82317DB648
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=04c2a55d49214a29bab042353dc11475.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76761GAh5xk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4170220014785775
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9n/ERW7+rXTGVTFXN:SbFuFyLVIg1BG+f+M+a+rXOSjLkGq
MD5:	A09999845C2EF4AFCFC68F23D7A38047
SHA1:	63AE8A126E6722AE202BEB28717E52760645ACB5
SHA-256:	DAC27E4D2EA6F908C2BB86F1441A61A48B89F6EF674CF846E05F8FD4A8058806
SHA-512:	6A154ECEF8D02796CFB831C66B4888B720CD620F3D6CC677175DD0AB230804487CC0957580ADEFDE8E2A79C8BFE61BDD96A4C1BCABE7E18511EA881574163C17
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=753f8523d9aa4348b7acc6fe0d26c060.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76766RBK5lg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.450040972526847
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8c/hWXYuqjdCt/rRMtq:qgFq6g10+f+M8AhWXmCDL
MD5:	080387E993F5103214F97F5FC7917452
SHA1:	5A97763703726AF23D36A5334CA682B73234A3EF
SHA-256:	392B09FA1A091E0CD25A60D945F02E6730955255BADA6E1DFB537F1F7440C7F8
SHA-512:	7ABE5FD68047F300B4E516C36196CBAC7ADEB3ACFDF57B735C357D820D3E76EEB6FABF6C952A47A72F0EE87AB50F9A4B12CBD53AED051D83C6F46FDE3534A3E5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5cf858ce4400495db837c733f5fd13c3.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76775EPxfqg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.344930083064945
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+5mQX0+XPDX8dv8js2R:SbFuFyLVIg1BAf+M+57X0+/wt8jNTZD
MD5:	FB8BE64BF2BE7991841CDDEF9E52CD0F
SHA1:	6E2EB2A7D058DF4BA6DF8BF17C9E664028C7C980
SHA-256:	FEFC3B30452C8D2E97EE22E4B0386C7862266BD6EB6081C02EA29156E3C9E6A0
SHA-512:	85BD835FC5F0F7C0F3047424B82D080F059AD0BA3464C1F7C941310857A28E2F476280F286D22E1A39FC40A7828FCC411AC3620215992C3810FCDF7FF8B70077
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49001133ece24022b1012e9b37c12b98.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76797F4DPcj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.399011332615362
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MSUSzWYEujLTTIWTIL:qgFq6g10+f+MnWEWEL
MD5:	C3E71FE4DCFCFC1AF89E6EED369C6E62
SHA1:	998FC7DE62F2E87284FB00EA9A40D630C2A47458
SHA-256:	F931D8DCBCE4F8DBC63F638D1760613A06B1AF986BAE2A7ED44F4FD4BE135B95
SHA-512:	45F5447585D932116ECE4731DA6C61742F8F2A01E6E5BFA88A7A9A8BF1EC5DAAE19A964763E04DDDE44B810A176FD2175CBCC2254CD1E79109B0FF7CFF4F9ADE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a891c0266aca4a68b2d3a97a9f20fc66.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78861iGgKqk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.387091575938531
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/XmERpQiGv8js2q:SbFuFyLVK6g7/+BG+f+MPzwX8jNq
MD5:	5A9EFC4381CD4937CA71FA6D0774704C
SHA1:	DCAB6F2BEEFF2493CFDD706B7F72C0CC62D73B35
SHA-256:	DF60F7FCAB954548D10F9DDFDA031135E22EA068A8634862E2C6003FB971821C
SHA-512:	D1E6DB8B4DAFB9BD2C888272656CB68E053E48B1ECC16D0940A465CC042C63763E9F5033479A289E323819ED8A024479FA2C5F7758F8EE38E654785C509E1AE0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5dba1bca44724ded8dd49087ad8f00c5.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78862dp6MHj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.407485998572868
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmsAJBDgtLIURBxBM:SbFuFyLVI6g7/+BG+f+MsqgtlTjNq
MD5:	F81E312A3999AD2699FF0504FE34A361
SHA1:	362F06D2A0B1C1BB4E85D17B01F5E2765DA4F651
SHA-256:	3BFAAA5E75DA9FF2FD64EEF4537FDCE8B79D86D4F6BE728984732349514FC455
SHA-512:	661150EDF7743B6C7351E72B422CCA2A9465223A1E42CE23F259D8F082D8A9CEF6DBB5AA6E64F55AE6EB5D06A7BF2539C7A99E4A8D1FC36828650D57460F465F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fef0d26943c842bd891714defcdaa009.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78883tF4Pyj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.548831213785255
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MBXA4GU68jFQMzKaBu:qgFqo6g7/+0+f+MhA4Gh2Tmh
MD5:	85B9311DDE2A56A01C1C27A884C685AB
SHA1:	22A11F9129906E20BEAFC58ACB7135D72BE72615
SHA-256:	5A319A861BB4198F812AC416540B2C6E59E5ED9F2B9FFA42BC5F774337ECFC3B
SHA-512:	30AC6FA5A1175B652C5FB43B014F97E78516B4813553936F0A9FAA19C9DE54CC91C44E2F19EA953FDC61476797AC29294BDDD9E5222318A9C51000EFDA905103
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce1f2862eeca47ed8b129f09bd347615.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:7888432oXtk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5139444443839025
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzWh2ROTjs+QMzKh:SbFuFyLVI6g7/+BG+f+MqQOjFQMzKaBu
MD5:	3F65AF9149B534A7E54C97C4B9322679
SHA1:	AA886C1304BA86D955FD82BFF26C71ED6F69E14B
SHA-256:	E3B95C36ECB8D086F21ACB233F6C576C5C116542BFAD6E6253D18E7E497B6D75
SHA-512:	2F4FF6F715F5A5FDC24219CC1E8067F962A7D79C1F907AEAAE35FDB12AA7DDEAB2672F1085BBE5E641D6DFEBFCBDB588EAC5C35548F191AF882A98A7426EA793
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9640841b95664d209078c2808e1be306.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78972r21UEj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3451379895568225
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu2QjKEDtdFAgrxsje:SbFuFyLVIg1BG+f+MuGEDzmjdCLKzK
MD5:	C53B1183568D8B994D4F779C40604A20
SHA1:	D176458237F5D0C33BBEC0B7C337159D0BA7912B
SHA-256:	F8AD65D233AD60D795D386E452E114A97228A366DD8E6D034EDB08AAA1ED84AE
SHA-512:	A9107E82EACACA91E5FA85790B9BB04B7E4E3D9B5F9E638752D768DA4AB278F4B7691E57E67314F5F2191D4E0EC6134DC26966068096264FD84409AA9DAEBAD6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dae4890da202475ca25d6abd00fa31a0.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79080ds6slg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.40890221795422
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4JABH3l6SVJAg2jsc:SbFuFyLVIg1BG+f+M4JqH16pjosQu
MD5:	7ADBC3F2B6A20CA8FBE0999FEC9C20E7
SHA1:	0D798C199DAD05E61A4E10C20DC612C0E3C70E61
SHA-256:	A7A442ABC159CCCAD1FB53081E55A279500E79561A0F00EF1B41C0575F8D4B95
SHA-512:	67886FDA94561DF6F9241B5D784756BC57D5C38B35A8EF05BD01BE22E35464BF2DABD08E33C1912203B9A1682DAC4D1850AD22C7924A5158174FFEF272DDDB41
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2582722ef8b24da1b4b7da8c79fcdba7.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79153N0oh8j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.424961830586285
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoQVc8U1lFsZjLkGq:qgFq6g10+f+MoQVc8YNT
MD5:	C96E5AD1B8DCD16321BF10670CFF115C
SHA1:	0EDDD4A850374AAE10E85298C61C72B05CE97873
SHA-256:	07D9968468DDB3EB49EE5EF360F4346B3306D0457D9275699FC08C1F80ACF4AF
SHA-512:	A0325E89501BE4B251C05F1F1249445C3D15CC02DF9A0A4F4E8325F7D1BE719686BF27A90B78BA53C68E032D768FE0DFAF525F53F8B6D8DC9D221E13B8ED2C66
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bcf46f47a559492dab7c6541f3faeb1b.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79167uqoKJj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3732688328002025
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoEjsjDqEcfVwsjsmM:SbFuFyLVIg1BG+f+MoNCtPjdCLKzK
MD5:	84559379E16AF06308945B2FB7208740
SHA1:	FE1466606BF065B6E59E55BA2D023E27966534F6
SHA-256:	75F9C66B6266FDCC52FB9DDC291FB4BC526311FD3C621071C946B1BD780DE9D1
SHA-512:	C4ABCF4CB1A2FCB12AF9EA98BC290DD5BD8D2BFA270C10D183CC5BBBF30484D8BB1C4FFCDC9C8D02B4F17D8151CFC4A71C9E75700B7549855B169F793D6CE72F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba97f752af6143f6af0a96690cda9b63.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79208eiEZ2j

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.5169498680034
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4RuNZo8jZcHcljX+:qgFq6g10+f+M4RuuqmAu
MD5:	26B40A73D935DD267808F6A7183BBE72
SHA1:	4167200E205FB5D8DD554378D9E37E8E093C8CEA
SHA-256:	E921DE1C08965E1F1DCC67164B61F2AF644BF1752044F0413C09B9DCF610744E
SHA-512:	E0EA75496C85C1A13A6A520FF3AE2CC1D2CE841FC4A8C5566594A057E95B77BBF8739510980BC32B186C2923C802F2870732B4E02B94CEAAF5F0A33C399B3CAD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2542a134fb2e49889677701cb0905a34.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79228Cb0zFh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.469686364801628
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/n1ybR9SU/GX6Auqjsx:SbFuFyLVIg1BAf+M9m/lAuqjNALyAZD
MD5:	6C394ADA43F4B244B07C45D3AC271EA1
SHA1:	192DB264210A521143377B418F2DBC4F0AF8D9B3
SHA-256:	79F103E093C4578DDCE66F4AAFDD02AA9520A976F59331D299176BD7E6805797
SHA-512:	043055A894579B636681244C2034364B67FA0A70704F3B2F64538E691DC285C02D1E2749A6EAFD11462A879CD984AA3904F7963146FEC922B16593FEF4FCF5DF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=57145a48b8744394bfdd9bf18b65ec25.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79246KcM3Mk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.474429932980823
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8OLKiWE/rN2js2BbQIa:SbFuFyLVIg1BAf+M8O2O2jNdQIeXD
MD5:	E7B72661678F499F0A253606CCA6CD09
SHA1:	DDB3137E3A2AE937353B09D6E4662E46D034690B
SHA-256:	7E6981C7149E7676B24F528C838325BFD720693AE40AB5573D51CB320B3FB5C0
SHA-512:	B9AC56939ED7B59AC94006E431CC2F1581BD55C00CEB714EC8C1CD46E5194496AD54913590815C0AC833C0DD3DF77BD8AE3601FA6CCD2ADA31F2C7FF99FDA991
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6124354598c74a61832dee3dac4eb9d8.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79258P4JWvk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.415915519955107
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvhWHr91VTLT7Cgrqd:SbFuFyLVIg1BG+f+MJS5LT7j2josQu
MD5:	FC9C766CF2D059E107BB0C9FEBB80F44
SHA1:	A19B6A7B23202D78A4E16222DE819C63CB072AFC
SHA-256:	0F5413404F15BB9DC39F639B8F9D6CD3E7314AF0B58AB1DD7AF58A30AAB5319A
SHA-512:	59F0E60B7F5707D6B80477F74E024EA86F43CC752E8977BE5E6BBC27FEB8FDA182BE8DCF1A6B3A819781539437DEC591C175D3CB3BBF9CEDE1B178E285CA586F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eb58d53b929a4f7a906c9a02ae1a8e64.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79346uTsw8g

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.365329003692494
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+IcF0MGWGMqjdCLKzK:qgFq6g10+f+MQShMgCLAK
MD5:	2743AF96B22F16FF95076CF360CA0723
SHA1:	318C41D1C2DA65A429AC80112553D60BEE92B62A
SHA-256:	C55490AD4C514D61BE03DB2104AC434DE9E63BD387B90EE2F2E403A3CC6D1C64
SHA-512:	176FD48FCD8130291DC1CBCDBF61010B806522F85A9E831E98DEDC220867D7C1E8579C811900298AA56AC1E29452E2B7A8AAFE88D1C90E18AD8C469745B7F6AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e017e284e1cf4955b5d1023c54a035a9.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79468pi6Vok

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.406254481690244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+mceZRVSwuTXxvsjx:SbFuFyLVIg1BG+f+M+mrR4xXx0josQu
MD5:	CB7010A40F300F9682BCAC362310513D
SHA1:	2E80B98A101FEA10209B285A776E8F99FFBE1D76
SHA-256:	27A0FF64627B2DF352E30254487437028EB141DFE749A818396A7047EACA68FA
SHA-512:	0E39F579009DECEC581044A4A8AE79A9273288CA070A34EAE88B96DD88BEBF297049EC7842ACA91DC6E1F6A084D58BA181E693107902D572830F9C2E4380121A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4bc91b04840745d4bab5c2e0d6a2e863.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79553Z3RI0h

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.520835108786461
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MODsPvL2rqjZcHcljX+:qgFq6g10+f+MOovLzmAu
MD5:	2B3DECF4B4EF79BF72B28E5BB5ACAE0F
SHA1:	95C2B1A18F0ECF837204116C055B25D7CF85A34A
SHA-256:	6ECE128F9583580F9D76EECB1A38FE6A32DC63D5E550E98B631955FC5D0B6406
SHA-512:	3B73B705E994844A4FF9AAA8C6C822D1708A8C5005DE45CACF2126673F31FAE49C23C9D8AB633E10B1BBFC9E37D5E17DC8B1F82AFDB45494DC1D5AF251DB7140
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3e4d82d0b78f46f2b7243b9076584cf1.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80948IJyvU3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.52944387305359
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzwXOTsG04EWqjs7LH:SbFuFyLVIg1BG+f+MEX80Pji4s
MD5:	CD2DCF6354BA30709A26C224EDD3EFDB
SHA1:	F8DC8F96B05B313BF6DD64334D4242982399A4FA
SHA-256:	8B56D8CDB362DDA4F8E3CA9F7B76784A699DA14445B15F204CD345A3F1F56C21
SHA-512:	8484B69FE75778CCB97CD85094DF8BE73A1BDA3BE4031582B5715A7CA964F6A277C887B5C6CFE9D1CF130848A37C9FF3AF768D35385FB2AD9C6A13AD790BE7C8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=93e5288b36b84eceb2fa03b79dde107d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80955BGQOX4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.370911981859467
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M69MGJ1sMqjdCLKzK:qgFq6g10+f+Mut0MgCLAK
MD5:	9D9DB816C3BE494C8DBC5BEF44364AF6
SHA1:	5833EEAB155EDFAA27EF4028B787492FF92DA7AE
SHA-256:	A389DE0A627CA7D45CCEF7B65152E3CEB9E73BAB797F691D1C9A841B87167ADD
SHA-512:	7E838C3AFAA91B1BA200D2D5E0052ACFFB344F5D22EF8BD6FCF67588C499343B760926B900D3F84E279C8467FF7A03C2E80C00E5B0C11C78AA3F7B95DC997091
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f45603468bd408d9c01df996e7e9e91.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80956eklX23

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.439291078125492
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9BNGNwqtREM2rxsjx:SbFuFyLVIg1BG+f+MMNwuREMMqjosQu
MD5:	6A1C6DFC4565A8A759345978B9394B26
SHA1:	3D988D828FD61C8BD0BC249F9E8C677B9D7DE522
SHA-256:	AA44913C780A9D3708F83BBBB3377BED9FB0C1C6BFF27F9330007AE2BF613842
SHA-512:	44F9DDC66939FCE8D8B61E8632A31245974D437FF81FFFBCC4037FF4750049277BF57ED315A213E740207F37A3D768D258C762901A7684B344639E967D9DBF5F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7390bc3cebcf49d9986532e275433a1c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80968udWMj6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.482740992937474
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MAxkrHDTjZcHcljX+:qgFq6g10+f+MASdmAu
MD5:	C83A8A60E80178CAD9D8EAA51973DEBB
SHA1:	87287289D6F233A14526AD837DBDC11822184DB3
SHA-256:	82CF25C8621BC86D2520A20ED7E77BD97729F788992500C9E13E48E9FB4162AF
SHA-512:	95E72D8FB01571C5836126D43AC4B81E68696B168E683468E18ACC9E7DA359979070AC6F0A5D0C0C91635805263BDE8FC2AC52FC0CB533424F4068EEEBD99B91
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ad734387fdd4d53b930c2b0192b4d9f.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80969bv4pK5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.406412356788573
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyyHN9GKdTSEvs22je:SbFuFyLVIg1BG+f+MyUN9Gqv8jdCLKzK
MD5:	CAD4E9C0A56BCE47BA5A0A8677F58974
SHA1:	46FD0DFC650E56AC835CAE255D18434E5809754C
SHA-256:	C26C9B935ACBD3BB0C35238E4A8556C368BD07AD987E81F7898C6DBC5511F971
SHA-512:	863F4E11D5BBBE27F67C597178D074BEA3C801324FB8AFCE3A12693C567BB33D1E96A7F9CA2EF3957E6D4CDF1C5D13B39394FB4D61BC114A1F0F17A915D69177
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=831de861cfbf4958be9ca2c1864af254.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80970eWk4V7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.401759400485007
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mk9FXCovRqjNALyAZD:qgFq6g1af+MknCyRwIZD
MD5:	5A029C6E26527EF6DF697D5189AFA4C5
SHA1:	A08C7D9C7EED7DDD6CBB58A3EF7DD24EADEB4AA4
SHA-256:	6A8F2A1947746EB7161B4976E0D4218372E0AAB90EB76F88B5198A3FB03A8F42
SHA-512:	1BBAFCA9666120E01743EE04CA2B13566F6A9AC108C83ED62C5BC7E6EEB233F94AB63C523BFE6CA430C6E5AB10397CAE866E0550E5D59294E274FD233F6B88EC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ea053bedb30d4684934dee42cdec8955.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:809783biNX7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.442564251607259
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoDtRGRdt5NlsjswkT:SbFuFyLVIg1BG+f+MoDtRGR/2jLkGq
MD5:	79B40D501901E62DB30BB2A8EDD7BC52
SHA1:	6B646F7E5359FE62D1B41F907CA54B29E34D2DD4
SHA-256:	93DD3D163BBB950CF971DE1BC86B43B6E06499953C2FF59989DE4C096438B3AE
SHA-512:	754AC103F55F85900D553DBABAF5DDEB3BBFE557EB6AC2CFFFE576DF2F07D5B1D2D31D1D1D66959C280575EC09BDB7EB8CAEA1B8DCDD9362BE3D29F379F6E36E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bf74dcf9874c487f948d85094d11e56b.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:809791P5l76

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.505784231253679
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/h1dtQITCO2js2BbQIa:SbFuFyLVIg1BAf+MJbTuzjNdQIeXD
MD5:	E2EE8F104254AD8AA2FDC62B4A43516C
SHA1:	596C46E347BBC66CFB295829DDFF2E1A58280453
SHA-256:	D49BFABE1757E8ACEB511ECDA27195D517AF4B628FC7C085726DC29F4C055A06
SHA-512:	7561DC34AE881C42BA983C0D254D5B6F7504CD3F98382EB19FCFEEB67A3FDEE0D3748DAD81C51CE1C0A50952DFFE774546B977520B140819A57CDB418A046FA9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=545c7c930826499690ab6ffd29674bc7.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:809880cIJ76

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.37065578898838
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmz6c/+m8js2BZZGu:SbFuFyLVIg1BAf+Mv/+m8jNTZD
MD5:	90A91FC09C43933E36E2D7D48861EB42
SHA1:	77E546D2742458681BE4DA7F5AB9DF3AF32931FC
SHA-256:	F75890092828D2BF1A87813778E9B1D9E9172EDFF49674A57A152D81D7D6147F
SHA-512:	9076727AA7D4EAD6D9890C5D1FA757A40C4B06062AC90260772EB7B1CAFD192BAF38D55CCC3EC56638BFF824E6D8997A700AE7EA40C16445E194F135E45F4050
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9afa52ace040449d91016e0e8c554517.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81010FDAIS4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.431093131901048
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzfhIzXARMc8jswxJm:SbFuFyLVIg1BG+f+MSX0j8jLTTIWTIL
MD5:	53909B11644C4975C7833C18680187C4
SHA1:	67341E4727526761B924EFB6C727EB946CF0F638
SHA-256:	21189CE303AB00C9197814E34A342E42D9D25541B49750FBD24DBA222A5667FA
SHA-512:	170DEB04EF733062E8D9566185E96803CBAC6E83EE994C5D2544189202CC25CD8BDD811DA35CFE3B174CD31C486E0B72E4813B02F226E207F5FD46EEBDC6D073
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9d16ef45b79d4c9db62e4be0dcf167c7.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:810214BWtZ3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.422317111698161
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8fRcVXQnUD3VQ02rP:SbFuFyLVIg1BG+f+M8e9QU+NrqjbVC
MD5:	E0381D32600C7A251F0C3B0A49F025AF
SHA1:	B860D129DFF31E1ADB41A4A476390C715477A83C
SHA-256:	82DBCDF2B15586EB9B210123C44C64A3DB22FA9087FBF96EE790C4F1CABA16BB
SHA-512:	E517097059CCFF437D11B76FF2A00B887E70368AA2315519D6466770841D58F619818EA8261174CDBD98D0CC1C2642DB9F1B0C360BA5E6651EEF59409A035241
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=61cc4cfc2d2246e7ba492cb6531f9c05.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:81044HKjGZ3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.338405614024052
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9MdTmpgecjs2BD0:SbFuFyLVK6g7/+BG+f+MWRrecjNq
MD5:	55B30EE81307EA86EDDC2F2E2560CAE8
SHA1:	5423E3C885E084C50087F942EE0CDA6EE4D90BA6
SHA-256:	C32C7C4057A154C87D92297317E73248862BE48983C0AED48719E78B5695B509
SHA-512:	AAF66C73FD50A872322A9BC349306FBAB9400E45F76418B7538EEE9F532216D62AE18F348CB51AE5D7610A17D0402E673FDD4479F20F38E8A550176EE42FE277
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=729869a4160f4a6a87ee0079ef49e048.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81045tCR1A5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.416585678115521
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmv55FAhRH8ivshup:SbFuFyLVI6g7/+BG+f+MxLZi0ZjNq
MD5:	51BD36B1AB2AC4D8F7135088E2C2F7B3
SHA1:	615D496B1F6FC7018CF020B8E1AF837FECD5CA3A
SHA-256:	5E1D58556E975DD25FE97642C57C82B5F216BDF34AAFF36C40BBA42BD659EEF9
SHA-512:	E00EFF3F7A9F2C2A48F382FE302D13B8655C1242FE675D56F16F306DADC8C67D56297BFF91A4AF3FB0296548F8B9F9E08A7EF577363B9FCE31DF46F31F64ADE2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e0f260b11c354ae3bd0595bc5ae7d980.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81065zPLeW5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.485682213747095
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M37d/U2KZjFQMzKaBu:qgFqo6g7/+0+f+M37dATmh
MD5:	A7FDC4B8A92BC9B7B1204FCA84347162
SHA1:	48DEDD913F30DFE63821B36EC1F2475215BDE36B
SHA-256:	491FCCB47A8909E67B741653ED300AD318C5973E0D226DFCA02B2E012B7851BE
SHA-512:	06B08A958EEA80F2AEC601CDAE8051A3A3D8CA789113F58EF37CFDE8C345EF64984087047B6C1AAE6A5C6E1235926E574AD752BB7DCD6AB8EB51988728E5B11D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e288293a33954a88b52914beb6d09838.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81066tqQFM3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.47145668961627
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mujv8BjFQMzKaBu:qgFqdg7/+0+f+Mmv8HTmh
MD5:	346DDD384455C5A58979E6087B58267D
SHA1:	A42F12D121E7547B06228FD8A5F72B3471B652F7
SHA-256:	023E89D2C8AF41397FCFABCCFAE1BE453FC7C23043FB18C620669C0308976998
SHA-512:	EAB0335CF9EBF24C2258E48D519624360C4491EC1B6D5D6C399CEAA0E00A22F6D65A0C762DC306036EA750DB4C333E02A9FAEC396D6E6F1BB98692BD6F006748
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d05511eff90940c4b05a8c584ed70ead.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat04zcF8K

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0DbOmGR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Dy34LK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0ELYtHL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0XooAiO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0eKOyYR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0vdBCzK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1271nCXKN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.298134681646874
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGERWcrO2WBWi206qodqWQBW/n:SbFuFyL3BVgdL87iesnAiRJg9wc9Ct6X
MD5:	A49FCD2A6444B6FCF5FBFFF33A7E5389
SHA1:	A0A6B24C84F6316A27E53402A266CEA8F4A7FEB8
SHA-256:	9CFFB7ADD1A99709E2D1527086B253D063EDE3E9E61EFCF116DCD64CD94C372C
SHA-512:	18B0CF3A57EE0F5BD271499655877B17733CDAA19BEFBC47E9B401A09BF49311A3D12A7BD8BB4E7AB48BEC56CC6CDD84B6992B0CD28C1CCE92596DEE349419EF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733539178439049.MONOTONIC=513370087.LAST_SESSION_TIMESTAMP=513455132.

/run/systemd/users/.#1271xl30N

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2876210116413205
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6Jg9wc9h2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBQg6cathQHtPYq9M
MD5:	81D9CE7A0F80F969B50C6CA205A1938D
SHA1:	73120EE748E7B2C095A7A8B1153A31F2575EF8E6
SHA-256:	81184A5E5BB0F1F973AE92BAE1B716D456D0424CC82A3F987E785E317F575154
SHA-512:	ACE77AF91112E83786CCD3900F3295344E54F44CF1B85A4EEFF43196A150E1C20CCFF0AF7F962B31716631CE24D2219BF3F8711D767C8D862F762A4C5635DB36
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13944.REALTIME=1733539178439049.MONOTONIC=513370087.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1277lDVKR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.298468138486778
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGC1IIOwQJyTvDi206qodsCdF:SbFuFyL3BVgdL87iesnAiRJg3IG9TbiY
MD5:	1FDB78DDC7EF992661BDE1F110A366A0
SHA1:	E1A0788A6989939D4AD6CF2FDFC2B98292ADE6E7
SHA-256:	A963FB3ABF0A9FA81F827AEB821494D36E33E1E9F46F79BA86C47A5C0D47C363
SHA-512:	1F74801BC8BD26AA5FE0C1BF0259F1A6B9464FEAF2029D632CECDC6BEBDBEC4776537C1B1E1FC8B337B8264DCF75EA0F77541B4B620060333650A20AA5FAF9DB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733539240221488.MONOTONIC=575152526.LAST_SESSION_TIMESTAMP=575255880.

/run/systemd/users/.#1278fv0ZR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.465886757201653
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8Rg3IG9Tbit6qG:qgFq30dABibBERgr9qIqG
MD5:	5802B01F967FC876D9BACFE21F1BC176
SHA1:	C3E3CD0663D6154D4EB0308793F9B50A2C538A8B
SHA-256:	6C711EE2D19ED45E1AC6F615519B5EEF11D863860F4426AF4DE746606216069F
SHA-512:	D4C477870C72943899B81206F29643AF0533CAA8A5A1E6624BD10F99520488D07CB5F5741E87CE51DAEFD47B524059CA8D881D09F73D10DA0B64964135293360
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14743.REALTIME=1733539240221488.MONOTONIC=575152526.LAST_SESSION_TIMESTAMP=575255880.

/run/systemd/users/.#127BwqO6O

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27067783756874
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgrDO02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJgrDcthQHtPYq9M
MD5:	04DCEFB87838AD392FAF2678A387649C
SHA1:	A8F12730756FB8D91153AAFBD62F31A5BCD9A809
SHA-256:	A17246C65DB2FE7303B2CDEC198BBBD543FF8704920BCD72DDE3231C917826A5
SHA-512:	2A71AF2FBF177018FAE91DC3E5213652E1DD2ABCCCC51FF8B72735ECA7FB335F1DEEAFCE31D4A0B52269AFCCAD24001C1A9B557211D1945D87D1D7A03D16C5E6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733539140119020.MONOTONIC=475050057.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127G75U4R

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127N8YFyN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127NrLSYK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127UrVulN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473583690029787
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8LpJg9wc9Ct6sXB6:qgFq30dABibBEXg6csIGB6
MD5:	D55CB8F735E22EA57FAAB3F7B0AA4745
SHA1:	3800F154139C9319B50C0FF9653F06E5A7E23B9B
SHA-256:	85AB5B7BDCF9A7405AAAC99F634ACA9ACA390BCBCF999D7B07335C8994F4A66A
SHA-512:	C387A1F5104824EAB19000D2A7385B98C1776AB700266CD2E9200B859C18E5DFA4B082E4DC80347EA6CE237D0DDE01BBCA3823DFF34C3AD320D2A9BD002929F7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14006.REALTIME=1733539178439049.MONOTONIC=513370087.LAST_SESSION_TIMESTAMP=513455132.

/run/systemd/users/.#127VEw9LR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.465886757201653
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8Rg3IG9Tbit6qG:qgFq30dABibBERgr9qIqG
MD5:	5802B01F967FC876D9BACFE21F1BC176
SHA1:	C3E3CD0663D6154D4EB0308793F9B50A2C538A8B
SHA-256:	6C711EE2D19ED45E1AC6F615519B5EEF11D863860F4426AF4DE746606216069F
SHA-512:	D4C477870C72943899B81206F29643AF0533CAA8A5A1E6624BD10F99520488D07CB5F5741E87CE51DAEFD47B524059CA8D881D09F73D10DA0B64964135293360
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14743.REALTIME=1733539240221488.MONOTONIC=575152526.LAST_SESSION_TIMESTAMP=575255880.

/run/systemd/users/.#127XI2jVO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.27067783756874
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgrDO02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJgrDcthQHtPYq9M
MD5:	04DCEFB87838AD392FAF2678A387649C
SHA1:	A8F12730756FB8D91153AAFBD62F31A5BCD9A809
SHA-256:	A17246C65DB2FE7303B2CDEC198BBBD543FF8704920BCD72DDE3231C917826A5
SHA-512:	2A71AF2FBF177018FAE91DC3E5213652E1DD2ABCCCC51FF8B72735ECA7FB335F1DEEAFCE31D4A0B52269AFCCAD24001C1A9B557211D1945D87D1D7A03D16C5E6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733539140119020.MONOTONIC=475050057.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127lNvtcM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2876210116413205
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6Jg9wc9h2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBQg6cathQHtPYq9M
MD5:	81D9CE7A0F80F969B50C6CA205A1938D
SHA1:	73120EE748E7B2C095A7A8B1153A31F2575EF8E6
SHA-256:	81184A5E5BB0F1F973AE92BAE1B716D456D0424CC82A3F987E785E317F575154
SHA-512:	ACE77AF91112E83786CCD3900F3295344E54F44CF1B85A4EEFF43196A150E1C20CCFF0AF7F962B31716631CE24D2219BF3F8711D767C8D862F762A4C5635DB36
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13944.REALTIME=1733539178439049.MONOTONIC=513370087.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127mhF47M

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.276294054866527
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGQNx1g206qod5Qf:SbFuFyL3BVgdL87iesnAiRJgrD1gt6U
MD5:	522D90C1051CE908F72CE1BDC7DD16FD
SHA1:	FED86E0533D8C35B52DE3FA1D398CC5D9680B73C
SHA-256:	6890216851B9C07FDDA6173EA1EFC3DFCB1D0FEE15163195A98E4C1E2FCE9BDD
SHA-512:	24C69492EF46EC19967DD7D60CE40165963F6EF195591DF2B7EE4813545155CABE011F752A096BFCB281701518A5238D6019AFF699DD04F14437FEFF35FF2DBD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733539140119020.MONOTONIC=475050057.LAST_SESSION_TIMESTAMP=475132572.

/run/systemd/users/.#127mwPipS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3020208891335265
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff84g3IG9TvRf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE4gr97RethQHtPYqi
MD5:	181D3DCF1AC3629F881AF75A6CF7C090
SHA1:	7FF855171E0E126EFC487F9367D40AC6743D94C0
SHA-256:	6D8A8CDC8F4E1DDE4B071FB879433FE2FC5148401EA72AC6CFBE266CD286A349
SHA-512:	7A0A3C4ED0063F5B9533A5D6F844BB8FBD2D6766EB786354CAC27A3B27D8F7A2CB94B34486554F7FCE3FEE5EB38E1CD9B3828275C5B23A5243F452A78448384F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14621.REALTIME=1733539240221488.MONOTONIC=575152526.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127sDa2EV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3020208891335265
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff84g3IG9TvRf2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE4gr97RethQHtPYqi
MD5:	181D3DCF1AC3629F881AF75A6CF7C090
SHA1:	7FF855171E0E126EFC487F9367D40AC6743D94C0
SHA-256:	6D8A8CDC8F4E1DDE4B071FB879433FE2FC5148401EA72AC6CFBE266CD286A349
SHA-512:	7A0A3C4ED0063F5B9533A5D6F844BB8FBD2D6766EB786354CAC27A3B27D8F7A2CB94B34486554F7FCE3FEE5EB38E1CD9B3828275C5B23A5243F452A78448384F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14621.REALTIME=1733539240221488.MONOTONIC=575152526.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mUXvn:mU/
MD5:	5DE6479EF420D99CA2DED553B62DD6D6
SHA1:	0954822A6F7846100529460ABA9B6D5EFF1BEF64
SHA-256:	6871A3589990D59D5A1F37504FC604E3E9C035959F27EF5BA764982D818ABD85
SHA-512:	9D895D5A54D2924FA2484B22988AED708EBFB1630C01D3A2F646693E9891C2D70F300AA3943C6E637AD3DFD84FA1F6A6818B9E8415E5D4F87239A714D1A93920
Malicious:	false
Preview:	7012.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md6n:mcn
MD5:	228EC3F84A2F586D26F1FF886D27E667
SHA1:	21A871924871ADDB20DDBC9BB8350ED6C804D618
SHA-256:	FDD395567E91B5E9F982EC53F0D1C5F40A0867F3262A23B0EF9D1CE561E63AE3
SHA-512:	1CD47AAC39DE8A6BD9EC681FE957445FC10CF99728172941AFAE367502F41E3AB13EDE95D30ABA1D5B00DF08201DBFDE363F1F6B9CE64FFD33DC82E913D82FD1
Malicious:	false
Preview:	7085.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:ws1sXlXEWtl/Mlzf4/ll:y+ylkVAX
MD5:	CF21FDE54E2EBBC1E9C9B32B2557DC7D
SHA1:	D6EDD52DA4CFC63D024D3DD95575F593BCF93E59
SHA-256:	EA8D5B59FC945B49739E80A641CED22CC5F4EF21ECBCD1087F5678194DF600F6
SHA-512:	EE7DD4816095379DD8465B5EF181943F94A43905202A1F00D850D1092A6C82DAB3E8FDA816ADA42517DFDDFF6C91FB56345FAD1E80397C3051CCD04DCF28B717
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................Sg.z......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mdJn:mj
MD5:	E780A0C850D9A64D226B62008EE3C40C
SHA1:	FE2A5EC854D6EF38F05CF3868B822E32DDDAB006
SHA-256:	240ADDB852C8F074025DB740C8180CC39B1A9DF96246FFED9E92B8A7F039DB3F
SHA-512:	FC7574904294364BF230AE899D3CBA42FEF13E88CCEAF263724911A17753205543E075CCCE2E93040136121574F4C8307609537D571BB67C0DACDEACA12C794C
Malicious:	false
Preview:	7084.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mTj5t:mz
MD5:	FED38ADCEF793C6D919BB85FF48145BD
SHA1:	3F3570900EBE0B9884D83813FB3E0C468E482D32
SHA-256:	134E9B92D05D0C44CBFC90871266D6DA44C63FA590B046E0D13CAC731CD0E7F3
SHA-512:	51CD5988849BEFC2B25017E03CE2FB42C8DAD2DA76B61ECEEA41EECC8DA07424B2FDF3FFF926BFE3EB7AC4EB0A8C739BF347435CF4765D3D256C8635B0D965D4
Malicious:	false
Preview:	7067.7068.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md6n:mcn
MD5:	228EC3F84A2F586D26F1FF886D27E667
SHA1:	21A871924871ADDB20DDBC9BB8350ED6C804D618
SHA-256:	FDD395567E91B5E9F982EC53F0D1C5F40A0867F3262A23B0EF9D1CE561E63AE3
SHA-512:	1CD47AAC39DE8A6BD9EC681FE957445FC10CF99728172941AFAE367502F41E3AB13EDE95D30ABA1D5B00DF08201DBFDE363F1F6B9CE64FFD33DC82E913D82FD1
Malicious:	false
Preview:	7085.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mdJn:mj
MD5:	E780A0C850D9A64D226B62008EE3C40C
SHA1:	FE2A5EC854D6EF38F05CF3868B822E32DDDAB006
SHA-256:	240ADDB852C8F074025DB740C8180CC39B1A9DF96246FFED9E92B8A7F039DB3F
SHA-512:	FC7574904294364BF230AE899D3CBA42FEF13E88CCEAF263724911A17753205543E075CCCE2E93040136121574F4C8307609537D571BB67C0DACDEACA12C794C
Malicious:	false
Preview:	7084.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mTj5t:mz
MD5:	FED38ADCEF793C6D919BB85FF48145BD
SHA1:	3F3570900EBE0B9884D83813FB3E0C468E482D32
SHA-256:	134E9B92D05D0C44CBFC90871266D6DA44C63FA590B046E0D13CAC731CD0E7F3
SHA-512:	51CD5988849BEFC2B25017E03CE2FB42C8DAD2DA76B61ECEEA41EECC8DA07424B2FDF3FFF926BFE3EB7AC4EB0A8C739BF347435CF4765D3D256C8635B0D965D4
Malicious:	false
Preview:	7067.7068.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md6n:mcn
MD5:	228EC3F84A2F586D26F1FF886D27E667
SHA1:	21A871924871ADDB20DDBC9BB8350ED6C804D618
SHA-256:	FDD395567E91B5E9F982EC53F0D1C5F40A0867F3262A23B0EF9D1CE561E63AE3
SHA-512:	1CD47AAC39DE8A6BD9EC681FE957445FC10CF99728172941AFAE367502F41E3AB13EDE95D30ABA1D5B00DF08201DBFDE363F1F6B9CE64FFD33DC82E913D82FD1
Malicious:	false
Preview:	7085.

/var/lib/AccountsService/users/gdm.96AKY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.JDYCY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.YG2SY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.890052787706253
Encrypted:	false
SSDEEP:	24:hZea7G/QTAvYA2+VrM0pYrlcJrjLZrCQU:ovtfVPYrMrj9rCn
MD5:	C321DBECC44AB59A25414A6CEE9B11F2
SHA1:	F3062C0E960BD9104E49D5CBE15BDF38314FE41E
SHA-256:	6351A5F33D4669BB867390B051B280A430F4DB8449B06F35C0B3A60AA5B954A1
SHA-512:	B4A66A0D36601DB95DC6CDAA46F8410F7262484F90972894FFC486CB07F3A0F87923730983AB334934A86609737ADAA318EAAE4C4149E4D79D6FA53BA838EE39
Malicious:	false
Preview:	Dec 6 20:40:25 galassia systemd-logind[6939]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 6 20:40:25 galassia systemd-logind[6939]: User enumeration failed: Invalid argument.Dec 6 20:40:25 galassia systemd-logind[6939]: User of session 2 not known..Dec 6 20:40:25 galassia systemd-logind[6939]: Session enumeration failed: No such file or directory.Dec 6 20:40:25 galassia systemd-logind[6939]: Watching system buttons on /dev/input/event0 (Power Button).Dec 6 20:40:25 galassia systemd-logind[6939]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 6 20:40:25 galassia systemd-logind[6939]: New seat seat0..Dec 6 20:40:40 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 6 20:40:40 galassia systemd-logind[6939]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Dec 6 20:40:40 galassia systemd: pam_unix(systemd-user:session):

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.43656862359913
Encrypted:	false
SSDEEP:	3:F31HlDnpr3tZnpr3d:F3DptJpd
MD5:	D3AD1A3DF101AECDB0D4776C97A90381
SHA1:	DB3014B7C9855F5E721FA6E17ABA3EE9C355A32A
SHA-256:	4721F69C8ECC139254561C4B710E483898253C0C63EB8B247DB7935D0698F157
SHA-512:	0BDEE1EE7FAEAFC8DEC1E8EAFF016AD6AA83A6828927621600E393C0EC2FF9642CF67029D415D3765D21F015126438023F6817F66A74D67AB866D9FF92917104
Malicious:	false
Preview:	LPKSHHRH......................L..Z..s.m.......................................L..Z..s.m.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlWS3Jatl/+S3Jadl:F3G+J6m+JK
MD5:	8AA18B6DDE3ACFEA8D42EDFD2951E61C
SHA1:	77F5F4834768C3DE2BB2ABF079D1415989B255E9
SHA-256:	18A5357F694531029EB7B6EF563B1D3A904A7A6F546A820F5D34309FE64AB031
SHA-512:	304464183746554F1F35AD516149A027D9638D0C230221CD759A234F342A548CE1C2BDA7AE8EC3B549A8F609C09C51D2F2F26A5DAB758CBA6F0B33C4026AE19A
Malicious:	false
Preview:	LPKSHHRH................J...'.Aw......w.................................J...'.Aw......w.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12269
Entropy (8bit):	4.907590719111307
Encrypted:	false
SSDEEP:	192:zUohhhNfgqAIwr8jLc14r2Gr75KEm0ONhVyUyF:zThhh9fCkD
MD5:	2943970299424F047C8033839FABD3B2
SHA1:	0540B94D00C4939BEC92A842F49E7F51D2FEE2A3
SHA-256:	F99754B85F0F5E29E3F5D71FEEC3D76BE3BD7C23578CC86829B597787AB9974E
SHA-512:	38AFCC8EC46E47A0484F76BC438F7A05922DED2ADD276B23F79F296C2122A5FF6DE4DEEBE809D104379ACFD22B69D97E839E9DF5879B2F759896ABC9DEEF2B4A
Malicious:	false
Preview:	Dec 6 20:40:13 galassia kernel: [ 542.586035] blocking signal 9: 6218 -> 2048.Dec 6 20:40:13 galassia kernel: [ 547.607122] blocking signal 9: 6218 -> 658.Dec 6 20:40:13 galassia kernel: [ 547.609597] blocking signal 9: 6218 -> 720.Dec 6 20:40:13 galassia kernel: [ 547.612126] blocking signal 9: 6218 -> 772.Dec 6 20:40:13 galassia kernel: [ 547.622500] blocking signal 9: 6218 -> 936.Dec 6 20:40:13 galassia kernel: [ 547.623130] blocking signal 9: 6218 -> 2048.Dec 6 20:40:13 galassia kernel: [ 547.988648] New task spawned: old: (tgid 6962, tid 6962), new (tgid: 6962, tid: 6998).Dec 6 20:40:13 galassia kernel: [ 547.989502] New task spawned: old: (tgid 6962, tid 6962), new (tgid: 6962, tid: 6999).Dec 6 20:40:13 galassia kernel: [ 548.001163] New task spawned: old: (tgid 6962, tid 6999), new (tgid: 6962, tid: 7000).Dec 6 20:40:14 galassia kernel: [ 548.463145] Reached call limit: pid 6218, name open.Dec 6 20:40:14 galassia kernel: [ 549.385874] New task spawned: old:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	32158
Entropy (8bit):	5.064416974600714
Encrypted:	false
SSDEEP:	768:GKhhhE9xDP9xDP9xDorW5fQ8O8q+wGnzdxK2UZKWqIcoUyLlZfe48yr:FhhhTCIh
MD5:	681B468D37B6ECB9E9CBBDD6DA121626
SHA1:	5964CDD6E510E2AB7D89E5D35117BD6352BF82BE
SHA-256:	66EF56413740B1C4A82FE0285DC814FBA65B75B28BC856CDAFAD631670612493
SHA-512:	F4C2F7EC1AC49F7AB2A83D50B1BC416582FDF3745D187F6752CB9DD59CA9424EA639D8E2106F62C524DDB5640702C25AC2FA6015460410E47A491340E7D480CD
Malicious:	false
Preview:	Dec 6 20:40:13 galassia kernel: [ 542.586035] blocking signal 9: 6218 -> 2048.Dec 6 20:40:13 galassia kernel: [ 547.535147] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 6 20:40:13 galassia kernel: [ 547.535156] systemd[1]: Stopped Journal Service..Dec 6 20:40:13 galassia kernel: [ 547.536329] systemd[1]: Starting Journal Service....Dec 6 20:40:13 galassia kernel: [ 547.565657] systemd[1]: systemd-logind.service: Main process exited, code=killed, status=9/KILL.Dec 6 20:40:13 galassia kernel: [ 547.565741] systemd[1]: systemd-logind.service: Failed with result 'signal'..Dec 6 20:40:13 galassia kernel: [ 547.566401] systemd[1]: getty@tty2.service: Succeeded..Dec 6 20:40:13 galassia kernel: [ 547.566969] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 6 20:40:13 galassia kernel: [ 547.567034] systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 6 20:40:13 galassia kernel: [ 547.5676

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351417
Encrypted:	false
SSDEEP:	3:ws1sXlXEWtl/Mlzf4/ll:y+ylkVAX
MD5:	CF21FDE54E2EBBC1E9C9B32B2557DC7D
SHA1:	D6EDD52DA4CFC63D024D3DD95575F593BCF93E59
SHA-256:	EA8D5B59FC945B49739E80A641CED22CC5F4EF21ECBCD1087F5678194DF600F6
SHA-512:	EE7DD4816095379DD8465B5EF181943F94A43905202A1F00D850D1092A6C82DAB3E8FDA816ADA42517DFDDFF6C91FB56345FAD1E80397C3051CCD04DCF28B717
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN.....................................................................................................................................................................................................................................................................................................Sg.z......................................

Source: iwir64.elf	ReversingLabs: Detection: 50%
Source: iwir64.elf	Virustotal: Detection: 50%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:50012 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:52670 -> 178.215.238.4:33966

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.35347139414352
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	iwir64.elf
File size:	168'168 bytes
MD5:	f4d0efeac26a54fc80b89808192df4ef
SHA1:	319ff7c3b4ca42095c1f8e0699257e470c15dd07
SHA256:	987197793b510546ae71404e1b94368d82ff874c643f3430508429187e764218
SHA512:	56efd6f5a55d5573ceddbeb5b154f2b431581e15a5eaf4c28f8d7fcf3ff3314ddc131732bda379254852d028e7530aa5faf3f2100c4a7e195501164d37fbca71
SSDEEP:	3072:Lm9vRQaLBVxFt4xmjgROVreJQjz/dlKB/rPVyOivmFHxtLNsDVzLGw9c:LmNRQaLBDFt4sgRO0UG7XFGVPGw9
TLSH:	D3F35C06B5C188FDC4DAC1744BAEB53BDD31F19D1238B26B27D4AB272E8DE205E1DA50
File Content Preview:	.ELF..............>.......@.....@.......h...........@.8...@.......................@.......@.....`.......`.................................R.......R.....(.......@...............Q.td....................................................H...._....z...H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	167528
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x1baa6	0x0	0x6	AX	16
.fini	PROGBITS	0x41bba6	0x1bba6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x41bbc0	0x1bbc0	0x3aa0	0x0	0x2	A	32
.ctors	PROGBITS	0x520000	0x20000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x520018	0x20018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x520040	0x20040	0x8de8	0x0	0x3	WA	32
.bss	NOBITS	0x528e40	0x28e28	0x7100	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x28e28	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1f660	0x1f660	6.3740	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x20000	0x520000	0x520000	0x8e28	0xff40	0.2388	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 7, 2024 03:37:54.970002890 CET	56853	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:37:55.331473112 CET	53	56853	8.8.8.8	192.168.2.23
Dec 7, 2024 03:37:55.332895041 CET	59266	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:37:55.573538065 CET	53	59266	8.8.8.8	192.168.2.23
Dec 7, 2024 03:37:56.961998940 CET	43708	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:37:57.202033997 CET	53	43708	8.8.8.8	192.168.2.23
Dec 7, 2024 03:37:57.203279018 CET	48314	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:37:57.337331057 CET	53	48314	8.8.8.8	192.168.2.23
Dec 7, 2024 03:37:58.726481915 CET	53976	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:37:58.987020969 CET	53	53976	8.8.8.8	192.168.2.23
Dec 7, 2024 03:37:58.988193989 CET	48728	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:37:59.122297049 CET	53	48728	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:00.510308981 CET	42827	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:00.644304037 CET	53	42827	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:00.645199060 CET	50155	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:00.779160023 CET	53	50155	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:02.200432062 CET	41985	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:02.334518909 CET	53	41985	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:02.335280895 CET	52739	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:02.726037979 CET	53	52739	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:04.112579107 CET	45153	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:04.246676922 CET	53	45153	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:04.247585058 CET	59846	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:04.381834030 CET	53	59846	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:05.771614075 CET	36778	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:05.905494928 CET	53	36778	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:05.906511068 CET	47196	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:06.040343046 CET	53	47196	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:07.427663088 CET	53604	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:07.550159931 CET	53	53604	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:07.550975084 CET	50412	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:38:07.687407970 CET	53	50412	8.8.8.8	192.168.2.23
Dec 7, 2024 03:38:42.798135042 CET	38950	53	192.168.2.23	1.1.1.1
Dec 7, 2024 03:38:42.798178911 CET	42081	53	192.168.2.23	1.1.1.1
Dec 7, 2024 03:38:42.935993910 CET	53	42081	1.1.1.1	192.168.2.23
Dec 7, 2024 03:38:43.028198957 CET	53	38950	1.1.1.1	192.168.2.23
Dec 7, 2024 03:38:43.431793928 CET	42565	53	192.168.2.23	1.1.1.1
Dec 7, 2024 03:38:43.569478035 CET	53	42565	1.1.1.1	192.168.2.23
Dec 7, 2024 03:39:05.222723007 CET	33768	53	192.168.2.23	1.1.1.1
Dec 7, 2024 03:39:05.441616058 CET	53	33768	1.1.1.1	192.168.2.23
Dec 7, 2024 03:39:21.176105976 CET	60618	53	192.168.2.23	1.1.1.1
Dec 7, 2024 03:39:21.313847065 CET	53	60618	1.1.1.1	192.168.2.23
Dec 7, 2024 03:39:35.775753021 CET	44873	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:35.909703970 CET	53	44873	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:35.910613060 CET	49774	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:36.045010090 CET	53	49774	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:37.435338020 CET	42143	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:37.569782972 CET	53	42143	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:37.572572947 CET	34185	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:37.812422991 CET	53	34185	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:39.202368975 CET	38027	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:39.336111069 CET	53	38027	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:39.338017941 CET	59187	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:39.698987961 CET	53	59187	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:41.088654995 CET	52148	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:41.223268032 CET	53	52148	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:41.224463940 CET	38220	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:41.477169037 CET	53	38220	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:42.862679958 CET	43298	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:42.996504068 CET	53	43298	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:42.997419119 CET	42447	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:43.131165028 CET	53	42447	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:44.519143105 CET	59578	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:44.642352104 CET	53	59578	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:44.643361092 CET	56537	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:44.779225111 CET	53	56537	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:46.164701939 CET	51552	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:46.298588037 CET	53	51552	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:46.299573898 CET	42789	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:46.433620930 CET	53	42789	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:47.819952011 CET	48865	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:47.942445040 CET	53	48865	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:47.943254948 CET	43410	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:48.077095985 CET	53	43410	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:49.464915037 CET	57431	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:49.600698948 CET	53	57431	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:49.601798058 CET	43329	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:49.724222898 CET	53	43329	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:51.118823051 CET	59454	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:51.252629042 CET	53	59454	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:51.253441095 CET	37674	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:51.387922049 CET	53	37674	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:52.774131060 CET	46123	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:52.908731937 CET	53	46123	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:52.909730911 CET	47060	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:53.035120010 CET	53	47060	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:54.425219059 CET	48547	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:54.547779083 CET	53	48547	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:54.548693895 CET	59096	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:54.997730970 CET	53	59096	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:56.384493113 CET	54771	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:56.518996954 CET	53	54771	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:56.519685984 CET	39031	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:56.653610945 CET	53	39031	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:58.071214914 CET	36706	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:58.193648100 CET	53	36706	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:58.194713116 CET	43618	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:58.328452110 CET	53	43618	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:59.715706110 CET	58034	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:59.850116968 CET	53	58034	8.8.8.8	192.168.2.23
Dec 7, 2024 03:39:59.851109028 CET	55240	53	192.168.2.23	8.8.8.8
Dec 7, 2024 03:39:59.985157013 CET	53	55240	8.8.8.8	192.168.2.23
Dec 7, 2024 03:40:20.328270912 CET	54017	53	192.168.2.23	1.1.1.1
Dec 7, 2024 03:40:20.328324080 CET	57724	53	192.168.2.23	1.1.1.1
Dec 7, 2024 03:40:20.467792988 CET	53	57724	1.1.1.1	192.168.2.23
Dec 7, 2024 03:40:20.550705910 CET	53	54017	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 7, 2024 03:38:45.559393883 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 7, 2024 03:40:05.570575953 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-07 02:38:47 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-07 02:38:48 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-07 02:38:48 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-07 02:38:49 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 07 Dec 2024 02:38:48 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	02:37:53
Start date (UTC):	07/12/2024
Path:	/tmp/iwir64.elf
Arguments:	/tmp/iwir64.elf
File size:	168168 bytes
MD5 hash:	f4d0efeac26a54fc80b89808192df4ef

Start time (UTC):	02:37:55
Start date (UTC):	07/12/2024
Path:	/tmp/iwir64.elf
Arguments:	-
File size:	168168 bytes
MD5 hash:	f4d0efeac26a54fc80b89808192df4ef

Start time (UTC):	02:39:20
Start date (UTC):	07/12/2024
Path:	/tmp/iwir64.elf
Arguments:	-
File size:	168168 bytes
MD5 hash:	f4d0efeac26a54fc80b89808192df4ef

Start time (UTC):	02:37:54
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:34
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:35
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:39
Start date (UTC):	07/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	02:38:40
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:41
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:42
Start date (UTC):	07/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	02:38:43
Start date (UTC):	07/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report iwir64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6916/oom_score_adj

/proc/7076/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:2296257zBjIUB

/run/systemd/journal/streams/.#9:2334585do60AB

/run/systemd/journal/streams/.#9:2334586N8EljA

/run/systemd/journal/streams/.#9:2334595HcrnAB

/run/systemd/journal/streams/.#9:2334602XIbwrz

/run/systemd/journal/streams/.#9:2334603L5A54A

/run/systemd/journal/streams/.#9:2334610HU9anB

/run/systemd/journal/streams/.#9:2334611oUNblz

/run/systemd/journal/streams/.#9:233462002pGJB

/run/systemd/journal/streams/.#9:241971798hLVB

/run/systemd/journal/streams/.#9:3373681mC5pXB

/run/systemd/journal/streams/.#9:4886065IyTcVA

/run/systemd/journal/streams/.#9:5330628BRVTxA

/run/systemd/journal/streams/.#9:5332291NC2f2B

/run/systemd/journal/streams/.#9:5788447On3N2A

/run/systemd/journal/streams/.#9:5788453XSAkyy

/run/systemd/journal/streams/.#9:5788455cSPbHy

/run/systemd/journal/streams/.#9:5788631e11BEz

Linux Analysis Report
iwir64.elf

Start time (UTC):	02:38:44
Start date (UTC):	07/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	02:38:47
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:45
Start date (UTC):	07/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	02:38:46
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:57
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:38:58
Start date (UTC):	07/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	02:39:00
Start date (UTC):	07/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	02:39:01
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:39:02
Start date (UTC):	07/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	02:39:03
Start date (UTC):	07/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761