Edit tour

Linux Analysis Report
wnbw86.elf

Overview

General Information

Sample name:	wnbw86.elf
Analysis ID:	1571047
MD5:	5f33f958945dce126f4f18ee23b09162
SHA1:	11bb26bd016673b201bf56c61087e6727736a971
SHA256:	ae156529ee59ea9218d3bbb7760d536e8becff7ff55659f9b723fcdfb1fa7726
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571047
Start date and time:	2024-12-08 20:47:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 57s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wnbw86.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/153@138/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: wnbw86.elf

Runtime Messages

Command:	/tmp/wnbw86.elf
PID:	6240
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

wnbw86.elf (PID: 6240, Parent: 6167, MD5: 5f33f958945dce126f4f18ee23b09162) Arguments: /tmp/wnbw86.elf

wnbw86.elf New Fork (PID: 6241, Parent: 6240)

wnbw86.elf New Fork (PID: 6242, Parent: 6241)

wnbw86.elf New Fork (PID: 6403, Parent: 6242)

sh (PID: 6403, Parent: 6242, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6404, Parent: 6403)

ps (PID: 6404, Parent: 6403, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

wnbw86.elf New Fork (PID: 6907, Parent: 6242)

sh (PID: 6907, Parent: 6242, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6909, Parent: 6907)

ps (PID: 6909, Parent: 6907, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6243, Parent: 1477)

sh (PID: 6243, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6243, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6248, Parent: 1)

systemd-hostnamed (PID: 6248, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6396, Parent: 1320)

Default (PID: 6396, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6400, Parent: 1320)

Default (PID: 6400, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6460, Parent: 1)

journalctl (PID: 6460, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6479, Parent: 1)

systemd-journald (PID: 6479, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6480, Parent: 1)

journalctl (PID: 6480, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6487, Parent: 1)

dbus-daemon (PID: 6487, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6498, Parent: 1320)

Default (PID: 6498, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6500, Parent: 1860)

pulseaudio (PID: 6500, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6503, Parent: 1)

rsyslogd (PID: 6503, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6504, Parent: 1)

rtkit-daemon (PID: 6504, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6507, Parent: 1)

systemd-logind (PID: 6507, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6569, Parent: 1)

polkitd (PID: 6569, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6576, Parent: 1)

gpu-manager (PID: 6576, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6578, Parent: 6576)

sh (PID: 6578, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6580, Parent: 6578)

grep (PID: 6580, Parent: 6578, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6581, Parent: 6576)

sh (PID: 6581, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6582, Parent: 6581)

grep (PID: 6582, Parent: 6581, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6583, Parent: 6576)

sh (PID: 6583, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6584, Parent: 6583)

grep (PID: 6584, Parent: 6583, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6585, Parent: 6576)

sh (PID: 6585, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6586, Parent: 6585)

grep (PID: 6586, Parent: 6585, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6587, Parent: 6576)

sh (PID: 6587, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6588, Parent: 6587)

grep (PID: 6588, Parent: 6587, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6589, Parent: 6576)

sh (PID: 6589, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6590, Parent: 6589)

grep (PID: 6590, Parent: 6589, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6591, Parent: 6576)

sh (PID: 6591, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6594, Parent: 6591)

grep (PID: 6594, Parent: 6591, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6595, Parent: 6576)

sh (PID: 6595, Parent: 6576, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

grep (PID: 6596, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6577, Parent: 1)

agetty (PID: 6577, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6599, Parent: 1)

generate-config (PID: 6599, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6600, Parent: 6599)

pkill (PID: 6600, Parent: 6599, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6601, Parent: 1)

gdm-wait-for-drm (PID: 6601, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

gvfsd-fuse New Fork (PID: 6602, Parent: 2038)

fusermount (PID: 6602, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6611, Parent: 1)

gdm3 (PID: 6611, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6616, Parent: 6611)

plymouth (PID: 6616, Parent: 6611, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6633, Parent: 6611)

gdm-session-worker (PID: 6633, Parent: 6611, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6639, Parent: 6633)

gdm-wayland-session (PID: 6639, Parent: 6633, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6641, Parent: 6639)

dbus-daemon (PID: 6641, Parent: 6639, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6643, Parent: 6641)

dbus-daemon New Fork (PID: 6644, Parent: 6643)

false (PID: 6644, Parent: 6643, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6645, Parent: 6639)

dbus-run-session (PID: 6645, Parent: 6639, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6646, Parent: 6645)

dbus-daemon (PID: 6646, Parent: 6645, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6647, Parent: 6611)

Default (PID: 6647, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6648, Parent: 6611)

Default (PID: 6648, Parent: 6611, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6617, Parent: 1)

accounts-daemon (PID: 6617, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6628, Parent: 6617)

language-validate (PID: 6628, Parent: 6617, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6629, Parent: 6628)

language-options (PID: 6629, Parent: 6628, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6630, Parent: 6629)

sh (PID: 6630, Parent: 6629, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6631, Parent: 6630)

locale (PID: 6631, Parent: 6630, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6632, Parent: 6630)

grep (PID: 6632, Parent: 6630, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6652, Parent: 1)

agetty (PID: 6652, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6653, Parent: 1)

rsyslogd (PID: 6653, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6655, Parent: 1)

dbus-daemon (PID: 6655, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6664, Parent: 1)

systemd-logind (PID: 6664, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6717, Parent: 1)

gpu-manager (PID: 6717, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6722, Parent: 6717)

sh (PID: 6722, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6724, Parent: 6722)

grep (PID: 6724, Parent: 6722, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6725, Parent: 6717)

sh (PID: 6725, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6726, Parent: 6725)

grep (PID: 6726, Parent: 6725, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6727, Parent: 6717)

sh (PID: 6727, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6728, Parent: 6727)

grep (PID: 6728, Parent: 6727, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6729, Parent: 6717)

sh (PID: 6729, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6730, Parent: 6729)

grep (PID: 6730, Parent: 6729, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6731, Parent: 6717)

sh (PID: 6731, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6732, Parent: 6731)

grep (PID: 6732, Parent: 6731, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6733, Parent: 6717)

sh (PID: 6733, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6734, Parent: 6733)

grep (PID: 6734, Parent: 6733, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6735, Parent: 6717)

sh (PID: 6735, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6736, Parent: 6735)

grep (PID: 6736, Parent: 6735, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6737, Parent: 6717)

sh (PID: 6737, Parent: 6717, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6738, Parent: 6737)

grep (PID: 6738, Parent: 6737, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6739, Parent: 1)

generate-config (PID: 6739, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6740, Parent: 6739)

pkill (PID: 6740, Parent: 6739, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6741, Parent: 1)

gdm-wait-for-drm (PID: 6741, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6747, Parent: 1)

rsyslogd (PID: 6747, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6754, Parent: 1)

dbus-daemon (PID: 6754, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6755, Parent: 1)

rsyslogd (PID: 6755, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6759, Parent: 1)

journalctl (PID: 6759, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6760, Parent: 1)

systemd-journald (PID: 6760, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6763, Parent: 1)

systemd-logind (PID: 6763, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6822, Parent: 1)

dbus-daemon (PID: 6822, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6823, Parent: 1)

rsyslogd (PID: 6823, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6824, Parent: 1)

systemd-journald (PID: 6824, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6828, Parent: 1)

systemd-logind (PID: 6828, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6885, Parent: 1)

agetty (PID: 6885, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6889, Parent: 1)

gpu-manager (PID: 6889, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6890, Parent: 6889)

sh (PID: 6890, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6891, Parent: 6890)

grep (PID: 6891, Parent: 6890, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6894, Parent: 6889)

sh (PID: 6894, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6895, Parent: 6894)

grep (PID: 6895, Parent: 6894, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6897, Parent: 6889)

sh (PID: 6897, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6898, Parent: 6897)

grep (PID: 6898, Parent: 6897, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6899, Parent: 6889)

sh (PID: 6899, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6900, Parent: 6899)

grep (PID: 6900, Parent: 6899, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6902, Parent: 6889)

sh (PID: 6902, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6903, Parent: 6902)

grep (PID: 6903, Parent: 6902, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6905, Parent: 6889)

sh (PID: 6905, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6906, Parent: 6905)

grep (PID: 6906, Parent: 6905, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6908, Parent: 6889)

sh (PID: 6908, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6910, Parent: 6908)

grep (PID: 6910, Parent: 6908, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6911, Parent: 6889)

sh (PID: 6911, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6912, Parent: 6911)

grep (PID: 6912, Parent: 6911, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6913, Parent: 1)

generate-config (PID: 6913, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6914, Parent: 6913)

pkill (PID: 6914, Parent: 6913, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6917, Parent: 1)

gdm-wait-for-drm (PID: 6917, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6922, Parent: 1)

gdm3 (PID: 6922, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6925, Parent: 6922)

plymouth (PID: 6925, Parent: 6922, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6939, Parent: 6922)

gdm-session-worker (PID: 6939, Parent: 6922, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6945, Parent: 6939)

gdm-wayland-session (PID: 6945, Parent: 6939, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6947, Parent: 6945)

dbus-daemon (PID: 6947, Parent: 6945, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6949, Parent: 6947)

dbus-daemon New Fork (PID: 6950, Parent: 6949)

false (PID: 6950, Parent: 6949, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6951, Parent: 6945)

dbus-run-session (PID: 6951, Parent: 6945, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6952, Parent: 6951)

dbus-daemon (PID: 6952, Parent: 6951, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6953, Parent: 6922)

Default (PID: 6953, Parent: 6922, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6954, Parent: 6922)

Default (PID: 6954, Parent: 6922, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6926, Parent: 1)

accounts-daemon (PID: 6926, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6930, Parent: 6926)

language-validate (PID: 6930, Parent: 6926, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6931, Parent: 6930)

language-options (PID: 6931, Parent: 6930, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6932, Parent: 6931)

sh (PID: 6932, Parent: 6931, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6933, Parent: 6932)

locale (PID: 6933, Parent: 6932, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6934, Parent: 6932)

grep (PID: 6934, Parent: 6932, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6935, Parent: 1)

polkitd (PID: 6935, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6970, Parent: 1860)

dbus-daemon (PID: 6970, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6971, Parent: 1)

systemd-journald (PID: 6971, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6972, Parent: 1)

dbus-daemon (PID: 6972, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6973, Parent: 1)

agetty (PID: 6973, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6976, Parent: 1)

systemd-logind (PID: 6976, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6990, Parent: 1)

dbus-daemon (PID: 6990, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6999, Parent: 1)

rsyslogd (PID: 6999, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7041, Parent: 1)

gpu-manager (PID: 7041, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7044, Parent: 7041)

sh (PID: 7044, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7045, Parent: 7044)

grep (PID: 7045, Parent: 7044, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7046, Parent: 7041)

sh (PID: 7046, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7047, Parent: 7046)

grep (PID: 7047, Parent: 7046, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7048, Parent: 7041)

sh (PID: 7048, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7050, Parent: 7048)

grep (PID: 7050, Parent: 7048, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7052, Parent: 7041)

sh (PID: 7052, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7053, Parent: 7052)

grep (PID: 7053, Parent: 7052, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7055, Parent: 7041)

sh (PID: 7055, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7056, Parent: 7055)

grep (PID: 7056, Parent: 7055, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7057, Parent: 7041)

sh (PID: 7057, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7058, Parent: 7057)

grep (PID: 7058, Parent: 7057, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7059, Parent: 7041)

sh (PID: 7059, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7060, Parent: 7059)

grep (PID: 7060, Parent: 7059, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7061, Parent: 7041)

sh (PID: 7061, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7062, Parent: 7061)

grep (PID: 7062, Parent: 7061, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7063, Parent: 1)

generate-config (PID: 7063, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7064, Parent: 7063)

pkill (PID: 7064, Parent: 7063, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7067, Parent: 1)

gdm-wait-for-drm (PID: 7067, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7072, Parent: 1)

gdm3 (PID: 7072, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7075, Parent: 7072)

plymouth (PID: 7075, Parent: 7072, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7089, Parent: 7072)

gdm-session-worker (PID: 7089, Parent: 7072, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7097, Parent: 7089)

gdm-wayland-session (PID: 7097, Parent: 7089, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7099, Parent: 7097)

dbus-daemon (PID: 7099, Parent: 7097, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7103, Parent: 7099)

dbus-daemon New Fork (PID: 7104, Parent: 7103)

false (PID: 7104, Parent: 7103, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7105, Parent: 7097)

dbus-run-session (PID: 7105, Parent: 7097, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7106, Parent: 7105)

dbus-daemon (PID: 7106, Parent: 7105, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7108, Parent: 7072)

Default (PID: 7108, Parent: 7072, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7109, Parent: 7072)

Default (PID: 7109, Parent: 7072, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7076, Parent: 1)

accounts-daemon (PID: 7076, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7080, Parent: 7076)

language-validate (PID: 7080, Parent: 7076, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7081, Parent: 7080)

language-options (PID: 7081, Parent: 7080, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7082, Parent: 7081)

sh (PID: 7082, Parent: 7081, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7083, Parent: 7082)

locale (PID: 7083, Parent: 7082, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7084, Parent: 7082)

grep (PID: 7084, Parent: 7082, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7085, Parent: 1)

polkitd (PID: 7085, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7095, Parent: 1)

systemd (PID: 7095, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7100, Parent: 7095)

systemd New Fork (PID: 7101, Parent: 7100)

30-systemd-environment-d-generator (PID: 7101, Parent: 7100, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7112, Parent: 7095)

systemctl (PID: 7112, Parent: 7095, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7113, Parent: 7095)

pulseaudio (PID: 7113, Parent: 7095, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7119, Parent: 7095)

dbus-daemon (PID: 7119, Parent: 7095, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7114, Parent: 1)

rtkit-daemon (PID: 7114, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wnbw86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wnbw86.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1596c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
wnbw86.elf	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x10398:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
wnbw86.elf	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x6670:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
wnbw86.elf	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xcb64:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
wnbw86.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x9412:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
wnbw86.elf	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
wnbw86.elf	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x100f4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
wnbw86.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xe69e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
wnbw86.elf	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x93e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6240.1.0000000008048000.0000000008060000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x15930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1596c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15980:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15994:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15a98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15aac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ac0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Gafgyt_5bf62ce4	unknown	unknown	0x10398:$a: 89 E5 56 53 31 F6 8D 45 10 83 EC 10 89 45 F4 8B 55 F4 46 8D
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x6670:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_5f7b67b8	unknown	unknown	0xcb64:$a: 89 38 83 CF FF 89 F8 5A 59 5F C3 57 56 83 EC 04 8B 7C 24 10 8B 4C
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x9412:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x192:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0x100f4:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xe69e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6240.1.0000000008048000.0000000008060000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x93e2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
Process Memory Space: wnbw86.elf PID: 6240	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wnbw86.elf PID: 6240	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xcae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcc2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcd6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xcfe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xd9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xdee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xe3e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 7 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6503)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6653)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6747)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6755)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6823)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6999)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6479)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6611)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6641)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6760)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6824)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6922)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6947)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6971)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7072)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7099)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7106)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7095)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.200.dr, syslog.297.dr, syslog.182.dr, syslog.45.dr, syslog.132.dr, syslog.188.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: Process Memory Space: wnbw86.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 840, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 840, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4439, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4440, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4482, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4488, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4512, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6403, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6404, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6655, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6746, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6479, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6664, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6754, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6755, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6760, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6763, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6821, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6822, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6823, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6824, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6885, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6907, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6909, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6922, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6972, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6243, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 840, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4439, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4440, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4482, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4488, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 4512, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6071, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6189, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6225, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6226, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6257, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6403, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6404, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6487, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6503, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6577, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6649, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6652, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6653, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6655, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6746, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6746, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6479, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6664, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6751, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6754, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6755, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6760, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6763, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6821, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6822, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6823, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6824, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6885, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6907, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6909, result: no such process	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6922, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6242)	SIGKILL sent: pid: 6972, result: successful	Jump to behavior

Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: wnbw86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_5bf62ce4 reference_sample = 4c6aeaa6f6a0c40a3f4116a2e19e669188a8b1678a8930350889da1bab531c68, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ffc398303f7208e77c4fbdfb50ac896e531b7cee3be2fa820bc8d70cfb20af3, id = 5bf62ce4-619b-4d46-b221-c5bf552474bb, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_5f7b67b8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6cb5fb0b7c132e9c11ac72da43278025b60810ea3733c9c6d6ca966163185940, id = 5f7b67b8-3d7b-48a4-8f03-b6f2c92be92e, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: Process Memory Space: wnbw86.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/153@138/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6487)	File: /proc/6487/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6602)	File: /proc/6602/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6641)	File: /proc/6641/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6646)	File: /proc/6646/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6655)	File: /proc/6655/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6754)	File: /proc/6754/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6822)	File: /proc/6822/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6947)	File: /proc/6947/mounts
Source: /usr/bin/dbus-daemon (PID: 6952)	File: /proc/6952/mounts
Source: /usr/bin/dbus-daemon (PID: 6990)	File: /proc/6990/mounts
Source: /usr/bin/dbus-daemon (PID: 7099)	File: /proc/7099/mounts
Source: /usr/bin/dbus-daemon (PID: 7106)	File: /proc/7106/mounts
Source: /usr/bin/dbus-daemon (PID: 7119)	File: /proc/7119/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6243)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6243)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6248)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:761518nRAY4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76152SXju17	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:77310bk9Hp8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:77412rVmTO8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:774158ML7N7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:77684pmkGa9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:77685mzJAW4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:77808ow5oP4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:77894NAaUH5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:779517MMP17	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78927kBOKM7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:77973JkRcf6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78037CIXfx7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78138dYhRc9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78169R37t68	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78170qr4HR7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78196mXfAr8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78197IbPgT5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79407Iv7YG4	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79567mxDlV7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79573QFvUw8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79668WXrqd7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79796b1tPT8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79892hF3cr6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79968dxSND8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78609OOJb37	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78702Fo4S05	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	File: /run/systemd/seats/.#seat0SYJWIf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	File: /run/systemd/users/.#127QKXB3c	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	File: /run/systemd/users/.#127Nmaw1e	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	File: /run/systemd/seats/.#seat0waDEpf	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	File: /run/systemd/users/.#127x17GId	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	File: /run/systemd/users/.#127iM9Bdf	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6569)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6639)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6617)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6617)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6664)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6664)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6664)	File: /run/systemd/seats/.#seat0TFTOJ5	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6763)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6763)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6763)	File: /run/systemd/seats/.#seat0nml4cz	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81464GgdLtb
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81465utqcEb
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81540gOoSud
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81542q2BmWb
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81556bxWO7b
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81557SvsCna
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81558qML5ke
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81559R4bu4a
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81650E2AlXa
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81747lDh2md
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81842jdibza
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81885uWpx0a
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81887m8Nozb
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:81937jB0kzd
Source: /lib/systemd/systemd-journald (PID: 6824)	File: /run/systemd/journal/streams/.#9:819438MlOse
Source: /lib/systemd/systemd-logind (PID: 6828)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6828)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/seats/.#seat0mbcwst
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127dRBClw
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127gArnPt
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/seats/.#seat0Nek7Ov
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127dPVhNv
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127XDxItv
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127ypwdKu
Source: /lib/systemd/systemd-logind (PID: 6828)	File: /run/systemd/users/.#127wFK9ou
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6945)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6935)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076514nFn7qi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076523BYGHxi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076524tK4yCl
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076525RwlACj
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076526xxW0qh
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:10765423vr4dl
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076629c5vtWk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076630b3MRvk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076714OyopLh
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076816OmGphh
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076924ccMzHk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076972UuRPGi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1076974KgxWPk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1077112MD3tPj
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:10771259c5Erk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:1077127uHYyBi
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:4201535uETkuj
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:4201583G3FhZk
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:4201693DyZsok
Source: /lib/systemd/systemd-journald (PID: 6971)	File: /run/systemd/journal/streams/.#9:4201851Ouqdoi
Source: /lib/systemd/systemd-logind (PID: 6976)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6976)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/seats/.#seat0PuH6ZG
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/users/.#127bRT1aJ
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/users/.#127eheB0G
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/seats/.#seat0w5GbKE
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/users/.#1270G3imI
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/users/.#1279dRJVG
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/users/.#127Wu3P6H
Source: /lib/systemd/systemd-logind (PID: 6976)	File: /run/systemd/users/.#127sYnIiH
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7097)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7076)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7076)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7085)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7095)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7101)	Directory: <invalid fd (4)>/.config

Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7076/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/6991/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/6991/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/6990/status
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/6990/attr/current
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7089/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7089/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7114/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7113/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7113/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7113/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7095/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7072/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7097/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/7085/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 6990)	File opened: /proc/6976/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7099/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7099/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7099/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7099/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7099/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7099/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7099/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7076/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6991/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6991/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6991/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6991/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6991/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6991/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6991/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6990/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7089/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/6971/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7114/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7114/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7114/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7114/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7114/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7114/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7114/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/cgroup
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/comm
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/cmdline
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/status
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/attr/current
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/sessionid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/loginuid
Source: /lib/systemd/systemd-journald (PID: 6971)	File opened: /proc/7095/cgroup

Source: /tmp/wnbw86.elf (PID: 6403)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/wnbw86.elf (PID: 6907)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6578)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6581)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6583)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6585)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6587)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6589)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6591)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6630)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6722)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6725)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6727)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6729)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6731)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6733)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6735)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6737)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6890)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6894)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6897)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6899)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6902)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6905)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6908)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6911)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6932)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7044)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7046)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7048)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7052)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7055)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7057)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7059)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7061)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7082)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6580)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6582)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6584)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6586)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6588)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6590)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6594)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6632)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6724)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6726)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6728)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6730)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6732)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6734)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6736)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6738)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6891)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6895)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6898)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6900)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6903)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6906)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6910)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6912)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6934)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7045)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7047)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7050)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7053)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7056)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7058)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7060)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7062)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7084)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6600)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6740)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6914)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7064)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6404)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6909)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7112)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6404)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6909)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6760)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6824)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6971)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6577)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6652)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6885)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6973)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6611)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6611)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6617)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6617)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6922)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6922)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7072)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7072)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7076)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7076)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6503)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6503)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6576)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6653)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6653)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6717)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6747)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6755)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6823)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6823)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6889)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6999)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6999)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7041)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wnbw86.elf (PID: 6241)

File: /tmp/wnbw86.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6576)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6717)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6889)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7041)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6404)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6909)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6500)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6600)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6740)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6914)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7064)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7113)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6248)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6500)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6503)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6576)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6577)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6633)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6652)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6653)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6717)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6747)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6755)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6760)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6823)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6824)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6885)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6889)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6939)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6971)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6973)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6999)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7041)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7089)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7113)	Queries kernel information via 'uname':

Source: syslog.45.dr	Binary or memory string: Dec 8 13:48:54 galassia kernel: [ 480.151037] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.45.dr	Binary or memory string: Dec 8 13:48:54 galassia kernel: [ 480.151067] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.297.dr	Binary or memory string: Dec 8 13:50:38 galassia kernel: [ 584.110694] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.297.dr	Binary or memory string: Dec 8 13:50:38 galassia kernel: [ 584.110720] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6617)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6926)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7076)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wnbw86.elf, type: SAMPLE
Source: Yara match	File source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wnbw86.elf PID: 6240, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wnbw86.elf, type: SAMPLE
Source: Yara match	File source: 6240.1.0000000008048000.0000000008060000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wnbw86.elf PID: 6240, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
wnbw86.elf	42%	ReversingLabs	Linux.Backdoor.Mirai
wnbw86.elf	100%	Avira	EXP/ELF.Mirai.Z.A
wnbw86.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
raw.cardiacpure.ru	178.215.238.4	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.200.dr, syslog.297.dr, syslog.182.dr, syslog.45.dr, syslog.132.dr, syslog.188.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	iwir64.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	iwir64.elf	Get hash	malicious	Mirai	Browse
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	SwiftSec.sh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	SwiftSec.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.mips.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
raw.cardiacpure.ru	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	iwir64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.mips.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	home.arm.elf	Get hash	malicious	Mirai, Gafgyt	Browse	200.1.79.189
	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	17334905466c073176eadfc4a4d1af620c5aa97d12d1156570ede93d276f9fa6d51fffb6c5778.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	45.88.88.7
	1733479268d0423578683b481c87d2b90a74213612e8837faf7f066c8e81ec92f9b2658c65965.dat-decoded.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	45.88.88.7
	17334178295ea73ab6cd4726fd542025ef7b7421cc440e3878f9b14a611f40e1dc873ff7cc498.dat-decoded.exe	Get hash	malicious	Njrat	Browse	45.88.88.7
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	rbot.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.sh4.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	atlas.arm5.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
INIT7CH	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	SwiftSec.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SwiftSec.x86-20241208-1849.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SwiftSec.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SwiftSec.mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SwiftSec.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	SwiftSec.ppc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
CANONICAL-ASGB	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	SwiftSec.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SwiftSec.x86-20241208-1849.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SwiftSec.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SwiftSec.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	SwiftSec.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arc.elf	Get hash	malicious	Mirai	Browse	185.125.190.26

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6644/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6950/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7104/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mSXvn:mS/
MD5:	EB5467AB16852B1EB907BF2A49093FF5
SHA1:	AF7956EE23D3BBB4DAFA97D65BFE8C06F9D35683
SHA-256:	F99ADA3DF8D4B72CFE20D9D3A11196E041CBA765A27D4AA0E79E788963991A81
SHA-512:	F9B1CD9C11B0E9FC6CC9EB8D5B1C184664ECB02DF7F2BD358F710E91EAA6A799556B5D7F9964D759A4F1043E8E2401B8716A9DB425DB79774E936D52E40BBCFA
Malicious:	false
Preview:	7072.

/run/systemd/journal/streams/.#9:1076514nFn7qi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.416645133505295
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp5HWSESf7Tgg2js16:SbFuFyLVIg1BG+f+MCSTTcjoa
MD5:	AB507130602033FD444769310DA8D7E1
SHA1:	F7E0544F5943EDC59DDDCA369D3FECAF29AC715A
SHA-256:	0399F03606E1E2362B2B17F97683738B12FB531EE3131B36B21E5651EE0EE2F5
SHA-512:	BE58D46550A43688FDBF106E89F768B7EB290776D9CAAC017C958AAE8BC129DA90CCCD30865F321643CC45FD34FBEB92A7EFB3DF3F46B1784BFE060CC50F8C43
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce9295db94484517a75cb5322626fde9.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:1076523BYGHxi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.392834312180738
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuiBQc+WDGQDbTlrUA:SbFuFyLVIg1BG+f+Muzc0QDNUETjosQu
MD5:	7CA82FF89E6EEB062579725C4DD55997
SHA1:	67CA643408A6D9F44354C357703BACB44AF32D09
SHA-256:	A429C83566FB41681B594619C532CEE6A406E543F6E683C8D0B5C3F5F9AD7843
SHA-512:	6151B7A6C8E5945F7BF1EC1A1D28CFF27E0D9B041ABB25FB0FF787E22D3CA4CDDE50F60010CFFB865E333CBE8CE686158751527D5036F8092C131A2A41060D27
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=def0d59a236d4c5f81856eef0ea1fbff.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:1076524tK4yCl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.501935622603491
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4KkLEJ3R+8jZcHcljX+:qgFq6g10+f+M4KkoJpmAu
MD5:	3C04D60C8EB912FE8F6068F45CEEC7C5
SHA1:	CD1D9E429BE1990AF8C4C68D9CE831060436B7D5
SHA-256:	F854826BA0541C98F9D0B281932C672340BA983CFD5550221A56107026F49FA2
SHA-512:	DA08706C647F37EA69B58ED4B954A7191582DE362D4902108D6AF6CF95B15508960B939AF83F68DB8F62A5121E3ED54075786D6B6D2DD3722C69AE60D58EA5CB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c77272f9c994b2f8c551439c52a4ae7.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:1076525RwlACj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.429909539430534
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4cGhQNVHTQXH/XSQ8:SbFuFyLVIg1BG+f+M4cGGzTCzYTjosQu
MD5:	F48CE13DF6618D7D95C8DA3DA479CE1A
SHA1:	8FADC347E22939F9D8A20D769365627C82BFAB3F
SHA-256:	403D2D05A3CD5C7759A578EB1014499AD87A5929570743DD6220358C65D60B35
SHA-512:	BDDA5B2A85D4A6627F47EE5F1C4421D0CF505FF24CDF52E7AC65BE2E44EFC955B259387DB0C9FF90E1697AF13C62DCDB5F0D06506BFAE9569C6E4EEBF5B83DD0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=299968a9bc5f49e6b687f22b002ab85b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:1076526xxW0qh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3768276775812645
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm++ybUxnPKtF2jsmNm:SbFuFyLVIg1BG+f+M+f4SGjdCLKzK
MD5:	EA3A9A35113800047D871E2868A40035
SHA1:	A1D7EB1791A9DB669D81DC44E66F7F2A4F769C93
SHA-256:	C332DF22F4465CDCB9CE3FFBBB2B2B367F73F2175E8E6DC7AF2CBAF19D145A18
SHA-512:	BD3A40A6A868870C3BA6F14DC23A376C173CAB671BEF1F49600E35916EF369BE30CE7B3967821C0AD3C6984267AA32A5AA31CDC4F65DA7DD8EE6AC4BD4ACCEDD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4eb8e2c7efc1420e91186c1de85b807f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:10765423vr4dl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.401822845046347
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmukSxHS6+hqA4jswkT:SbFuFyLVIg1BG+f+MuNS6+KjLkGq
MD5:	4C5B032379B0D533ED0A423787B5EFB9
SHA1:	F9F47F3843552712542E86CB2920042484408D2F
SHA-256:	6D997F023C0AD3D035DF069E8ED8DD11DE2BEAB478D7868BB30569324AFE39C1
SHA-512:	8FD72C56528B3878EE27D4FD0C565A638F407C186F85179BA23DC7601BC399838E723EEDA5E666E6226A885840D3630C8ED11FC14985F500DED7F850401E69BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dc5a7b5f3b744cb9ac2bd8eabc8ed145.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:1076629c5vtWk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.388694144575944
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M4UiUZmyZ2jNALyAZD:qgFq6g1af+M4U9ZmyKIZD
MD5:	7EA2DD0F00AEA7131F473E22FC83AA44
SHA1:	4E1B41865B96436EAC13DEC502302AA3AE21014A
SHA-256:	6F7E8446DBC1C740AA96B03D17397812913A3D6F20DFDA342794084A22B16068
SHA-512:	3B0B39A588EBB9CAF967C82F240E0A931136ED4255DB35342C417541ED54160CD072CEA4556A7C4B83F1EF8AAE266DB7D11F7F9DF80DDFF941F129E18C887703
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a20ec3eacd5b42a5930199be9cddeb46.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1076630b3MRvk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.463984140881953
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9wGXD2welsh+sjs2BbM:SbFuFyLVIg1BAf+Mta72hTjNdQIeXD
MD5:	B26302D43C0629000309711B2489F5B3
SHA1:	01C587F1F5E95F3B65FF9171647E548DE7874B6A
SHA-256:	41D3CB4716096E52DE580C2A5E70CD82221CE55F0CDAB27BD36C7BFC15A84357
SHA-512:	8D0A7A13D80768BDDE3C071EA00FD50E5E02A51650C2D5AE2746CC48F0BDEC6394E3DBFBCD74106C249ACF03DC3C0BBB1BF502151687926AE01FC213F0454696
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7c8a07c2f2ba4aa8b6433d09847f230c.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1076714OyopLh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.3075637204400525
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmygLJ0gDdRnvXsjs2BZd:SbFuFyLVIg1BAf+MygLddyjNTZD
MD5:	B5B40A071FBE29D1B63BA29B7F36D559
SHA1:	7991C40C1448448B0D8F9BCE66904765261E3CFC
SHA-256:	2924470A721605E8869CD0DD91F83DE24C4C39574893AB9D5DF4FC9D41A5452B
SHA-512:	11776E33B76CCE1E09B127FD011E16731DDCBCB54514E59FD1CB725DB7A38DD397AC7396533C5F0533CFFF5FBDA0C9B463AF5B747DF689A6BA18A5DFBBD686DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8110ef2ed23e4130858f84f0e08faa01.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1076816OmGphh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.434389527918431
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Me2cNfZ0U0jLTTIWTIL:qgFq6g10+f+Me7o1EWEL
MD5:	1358FE7B7058CD1271E09479E86C1B2D
SHA1:	9388C03552B26D8EF857E805FF352564EF773C42
SHA-256:	A83A5D713E560D78C9012F0785AAF26A6F823271582279D6A5977528BC2B1294
SHA-512:	195407A50DC525CCBEB9BE9D08086F6DFB6D380706486686A9EF6F6397D95483C033996C80589A75B07044B70B44A611193AB61DDC276B0C7D6D9FDBE7978030
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ca3e696d0794c06878229cb51127ebe.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:1076924ccMzHk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.406565404055074
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm68mTmWdc1RBGvsjs1:SbFuFyLVIg1BG+f+M68Gveb40jbVC
MD5:	3A1B5128C4B06572C575C593C573EA25
SHA1:	C25352E5EA058958B4ABFF4559C855AA2436167C
SHA-256:	9B93C4845D234B005E0495BF06994C4F0FD3EF90A4BA9CF3BEA13DB2F53ACEBC
SHA-512:	B4871490BB16461038A7E3B7342F747D379EB24D265ED5E42C696FBDA832AB0948F66A459DEB2C6ECA270224092F8CE96ABD7688AC988A4BA11550D06A46C646
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00670c14435c462b98189d4b04d31393.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:1076972UuRPGi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4379576832388
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm70GCeC90zBEC2Ys:SbFuFyLVK6g7/+BG+f+M4GnyBYTjNq
MD5:	A8B005FBE1DCEDC4E2A5EC66C6709924
SHA1:	4DA65E0B66B31732978B3844653963BB78BC1ACB
SHA-256:	2CEA0272A5A74E6F5B0E804367E7AB48135A5A2E1CF7F3EB583147E55C85E32B
SHA-512:	41B065A401D8677924F36FCE83E559DDFBC6CC89F854ABEB2B00562BD4CE2851D7964574FBCA6AB10C2438C16AD33AD33BDEEC23BDD5D392F0AE9D64EF647439
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=147c7fb489414d9cb2a7e7d043ac0335.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:1076974KgxWPk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.424342185638524
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M+XneY7hTGvFrqjNq:qgFqdg7/+0+f+MGeY5GvRwq
MD5:	A96C268B8A5B6D88D15F01E8A0F39DB0
SHA1:	A465C4C587386783EEFF8E6733F2025D97D06A0A
SHA-256:	C6E3E55059F23459BE045BD61249CBC972D50777914CB10D5EDC51BE8C575ABB
SHA-512:	78C4CB912DA4FA3657B8071D2168C2A9AE6B0EF4F4885C1E022C76AA0A395B819E93488D180728932692C0AE2308FE332637D3D58AC572072DE0ED16E20C4E0A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4cbf607270414e51bf2e4fb1d3dc636c.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:1077112MD3tPj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.433556338957891
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuWrAQI7+8jsicWmIE:SbFuFyLVIg1BG+f+MuWrudjZcHBrt
MD5:	2BCCBBD348EA4317D13F51D1B397E315
SHA1:	8069B9377DA88988D10847D5440C9CF8865526F8
SHA-256:	89A83DF3AE7F5FBF1A1917E0DD9D02B0B4B661AB7933D5F1A4D3024B230356B3
SHA-512:	65237493A0B96F0491F8ACEB1A2B1BD0F6FE3555C18E02A2E7D00FBB8F657B526967C16C73C4C3D5C17BEAB1CD25522FC01343AF996B7A79558EF12E589BBE7D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4c63a0d75034cd2a28c8135ca8f7cb9.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:10771259c5Erk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.506542716065082
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MpGvBDTs5nzZjFQMzKaBu:qgFqo6g7/+0+f+MMvZs5nzvTmh
MD5:	D4E669F95170BE37A029BDAC8A36CE3C
SHA1:	41293875D7DA08EAE0B796772A4E23545FF39F87
SHA-256:	0D76BF28485ED358C70E5CF8608FB3EF971D4034738BC84A6431BE636EABC72B
SHA-512:	89CFD2699828A025B69B969CC36D5F34C85CC3810FFB6100F1ABF35730203F075C60FDFF8FB6C9BC263CE7ADE96335A353A2F6C36F7FC593424E16116F9C149E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=382f06a61dbe4cd09df65673d2396b69.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:1077127uHYyBi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.511996273339972
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M6WYVTlQ8qjFQMzKaBu:qgFqdg7/+0+f+MiVT94Tmh
MD5:	68DB39A1A8B1D4063C67939F93AEEC64
SHA1:	B666E3B7353EE151FA218842F409B8129B0298AE
SHA-256:	7DBD26312328D8D4B1972567586F8D5753769BD19DCA8A20388C65339ADB256A
SHA-512:	D533023B58EAEA5A87C8E1ECD3BBBA90AADE10FD48C5B59330B8659110D8643A334E77E0BA6DB8D91BA165774A13388F67DAB7A9959746EA7A6EA3E9338D8797
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=08adb3696d524ef89b06f290d9d7145e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:4201535uETkuj

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.360238257250232
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzH1faGBDrvF2jsicz:SbFuFyLVIg1BG+f+MDkGr0jZcHjv
MD5:	D1981927A13A55DB70A1BC04AF4445F4
SHA1:	8D2B2EB2BF8C8DBA6DB52AA894144C0FD61D1A20
SHA-256:	49BE5938176F8544FE9618ED5CEFC87CC4229C42062FA6B88424146DB8185650
SHA-512:	F84774EDE0EBCBAD23F9328BB93D5CFBD7A980606BEE2ED08B005CB3EAD0A2B02065DD1BD018DE453DD2C1BC104728FA7C3884953E113B402CA45FB7A4E8FAB6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=94d22a9cf098408ab1501c1dc7d5349e.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:4201583G3FhZk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.354580469203092
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz8RTmzfZsjshQJWL0:SbFuFyLVIg1BG+f+MY1m7SjtWL0
MD5:	250AE75DF4A03EE5AB9B99CCFE2A7545
SHA1:	707C528A835AC3CFD614ABC0728DDBBD68BCC0AE
SHA-256:	18DC27FF9CAA75A7819E710BAED64A1E5617EC2C2DA45BCFD43302EEF5E9277A
SHA-512:	171383E7F8F90E79A265C0A6A127EC507BFB72B48A29CB466FEE6DCE07C03AA3D22FEBBDCF097E136F88F4402B76B8A40F15000E17A968D0306523333C7606B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=912646d576f04a57b26550b66d86b390.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:4201693DyZsok

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.424261212753683
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoEgcbzdEDDJAuqjsx:SbFuFyLVIg1BG+f+MoHquD6jNE
MD5:	7678ACE896E5FF76B58630ABA11DE0D4
SHA1:	B06298DB373CB229DE658D7367C66249B705589A
SHA-256:	B36998C5CA385CE76EE7F3839E98ED2127B45CAADA06DFE8D001CD85B0ABE007
SHA-512:	E8C369362C3262FFCD9F9421F62BF87374EB52CA97542628C8F1A7ABAB413F7DA15FF9BA7F227B6275868E60CEBF8F2578D86F9BBB7CB82D6A43F31FC23D1276
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b922dcd06b1d43d886d48d477e8a3af4.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:4201851Ouqdoi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.339671157808771
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrHRPncSdfsMqjs1Ha:SbFuFyLVIg1BG+f+MVPx8joa
MD5:	7905EE7F1230689B7F0486768763DBBC
SHA1:	FE853F5D6D651BA0A2C838699660245408DA4473
SHA-256:	FED7D9CA47CBFFEF753924146F3C317B36F5D3F423AC0584E76404E882144730
SHA-512:	74CE667437C15FFF779A699861F106F12C958172C0D551686A3B25A24FEB69E387427FDD159E736F47A832A35E87901ED558BB5B556313A279141D7D95C80FEF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ac6cdb604f7346c3ac4cd157cdc63944.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:761518nRAY4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.558839193959168
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7m6DN7B5TUBZMqjsv:SbFuFyLVIg1BG+f+Mq61HPqji4s
MD5:	A2EE27466F139AFC9795FE115ED2E608
SHA1:	CC0DEB57E5B3484B4C144A336EFE8B78B2BD8148
SHA-256:	8B3589ABE316B3C1B2F1B6831F6C297C40D559683A419BD844EE11008C67393D
SHA-512:	62A5C88A37AD88DF422E6608E70970B300DA7D537444FB975D0DCFD04FF4D29D9234C437660EE1566E68E87E239C84C24584371D5AAE9EDF17EB6654F2AA129D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d5485c7fa27419fb1f625d330061d89.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76152SXju17

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.522297558957477
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8DPDB+vfUsjs7LbgS:SbFuFyLVIg1BG+f+M8DPliji4s
MD5:	52CD34816CF7562573673FF463C775D2
SHA1:	A87B200D1D80F7BAAA709CF01131D6D4845F122D
SHA-256:	23551931724DE1E43D4BE90DAEADB5C6F0E5AB5043870C5F27AB75E64ACD5FA7
SHA-512:	AFA50E0B9D3E4593508CDFC09535C19CACE58E5D518D53989EA001824DC2DAE0312E7C6812B4BB0CCBF132D9A4057BD9D993A9D73C64EB7B98F121AEDA4A1467
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=67d5b7eff9a84f7481aba3abd0982a5a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:77310bk9Hp8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.404850331281419
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm66RRDj6BNEl9EHUBh:SbFuFyLVIg1BG+f+M663/63e9u2josQu
MD5:	6878E5A31C53BE382790360474C0E1E5
SHA1:	1350EE215B1646CFD058396E0A96DB81E31E5E75
SHA-256:	E24528300BA4E3D2A3A9FCD43A7A9B13A8DB5F92275D4EAFAA96D2F4F86A15E3
SHA-512:	ACFC37A4DBE6904C8094704143045D60912F9CA99083FA40B090F601C921CDCAA3F9F4C19F8C52ABEAA35EF02BDE32E615C66BB310A1C8BA60DDA3AADB836D59
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d51c44f75a64d11a91d4b8ab36d19fe.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77412rVmTO8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.380839537466537
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6CANcWcnWVGhMqjdCLKzK:qgFq6g10+f+MX0Gh3CLAK
MD5:	8972BC7BFBC72765630ABE2CF98BA415
SHA1:	280297BEEFB0EC0EBB74D58C3842445D28F4A5F7
SHA-256:	4BB5F28C91693FB4C59EB3F3C32272720AA4743FA1D67F1EB7C65F47330B55F8
SHA-512:	9DF0019BA59C9E64ADD39FB4AD414DBB9F2B433C89D4FB3017B24909B4237EA0D165092ECBF84F45D1886217400B5F8034F0DACF9A01EA7A8AD9EF5A12607B5B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0297b758eea84593939f337147f0711c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:774158ML7N7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.319626564564151
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvrwzZWDwjBYshgrxm:SbFuFyLVIg1BG+f+MTw9EwjBXTjtWL0
MD5:	3DB8436CA6237C12E8BAC08DAFE00B38
SHA1:	6C7DE64804F8320E0E608C96FBDA0C6930051509
SHA-256:	9270751D16B8A7D4605BCAA32929FF9BC1F732A79CDA1AEE831D891D53FF90A0
SHA-512:	210E50FA41DB9553CCA4F861A089B034829FCB379CFF06E2DEF96A16DE46AA24615FE132A45FFB3E77BFEFF5C879C865FF6A4292024EE09791206DD0920AC91C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=edfb9ae39b614319b3fe0be52df8b6eb.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:77684pmkGa9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.385656136699806
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpEWii0sopT0jsjOdy:SbFuFyLVIg1BG+f+MO2OpIjNE
MD5:	BFF2F82015699B9F157F03AC25275A81
SHA1:	107A862D862541A494EF0EE7066499F72BDABABE
SHA-256:	479EE02E90293A7073D8E162B5EDDCD8E5CB4A02EF0CA320E08C27EFDF183CD2
SHA-512:	6814B0F4EF57E880AD236495BFE232F82BB16249AE41FA9DBAA6F3EEF97A43DB7C8756541462A0EBF8541D586E32EA1D3F765C41BF82ED45A0BF2819A17D5C17
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc632eb44a7e4312a7ce7800aadc09d6.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:77685mzJAW4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.501745422694554
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MOuKRlQ9jZcHcljX+:qgFq6g10+f+M6lQfmAu
MD5:	6C9EA7FEB4F67447AC7C415DC476485C
SHA1:	718EA3BC7454578640069501D9E30FA3632A02A6
SHA-256:	E7CCC3B2AD38D322858B9FC5F973D5D882EAAB7A9CC036F01AA67347DDC5BA74
SHA-512:	14461F6ABAE5319994326481C5F5E506374A55AA784C79505C6F22CC25CDFA4DEA36155D4E32C5AD07E60F1000D6DC629C7A31472339F31D3C02BA07BF70DF7B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc7d57888d2941b582e168a91b94259b.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77808ow5oP4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.401591989378712
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5eQ8QmSyYUPERxsj0:SbFuFyLVIg1BG+f+MQQBmSyYUM8jbVC
MD5:	831AB347FB14F82A0021B9865901DC0B
SHA1:	E15F06F5A7BDF81C07AA603BFE7BC89DD22E5E86
SHA-256:	85D79759DCBFACFD1BD2603107C5C1224BA2B27C4019EEF6EE847D50BC0CD772
SHA-512:	9881B2674FCFEBA4A896A5DC71073FFBAF2D06BA19B71912EE8F29F6D18096DA99860FD56BD56E5B80D618BC6FA066FED64A484A1B4D8D3C0858BF8D9578BC48
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=37225035d578459e9be83d1c748d0a22.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77894NAaUH5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.447333402661813
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6ClD+NGT/Dqjs2ALAXA:SbFuFyLVIg1BAf+M61GqjNALyAZD
MD5:	1444A9072D09097ABF11EE36AA0EB57D
SHA1:	E4C0CDCA8DBDF58D6660B235330A27159E54ED52
SHA-256:	3F1D4CADDC6576B2EB86664AD04A00771F8A5C73FA2B306BE43631603BE2B2BA
SHA-512:	5AC726CF7DCF905D3AD2E6754458EC8CD19245B9776DB95460540C6D7B57C962EF74FFE0957ACEBFD20B17661A7FB15E351C8A78CC8F3DAEF34D53777C424B51
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00a798d6b96c4247b54c94ec61c03be8.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:779517MMP17

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.460118487066951
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm95un6dWvcRWvRqjs2BI:SbFuFyLVIg1BAf+Mq6AvVv8jNdQIeXD
MD5:	1BFDAFB713407CC8587E794E39787377
SHA1:	FA4E5E2B54F3295DE02EE656A16A7E6D19B1540E
SHA-256:	37F847FC3B3648512F18C4D8E040D3EF6C3B0AB5BD6F726F858F57AC1BDC48E9
SHA-512:	B66880C21E1488A360899495E579793779BD29428BAF8AFA37C4A6003B884CCCB6EC0010FF3BE506ED1F840E11F468C2F695CDB7753B30C82CD3273CE0559249
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7065b87116aa461c8f845fddac948e6f.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77973JkRcf6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.463835915630912
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsrrSTVrTjdCt/rRMtq:qgFq6g10+f+MsnSTtVCDL
MD5:	CB597448F8832ED50CE503EA55866999
SHA1:	0157F1897DF5A1C0EDCE159E37A6A4A9D69C2D98
SHA-256:	BE6AB4FBD25A82AC12D51A31B4652D54EBE0897841DB8776D38AAFF4FD5EBC4E
SHA-512:	FACBCE79826F272D2FB892A294AF27EE2F11A0915259E1A7C6D61834B5A6D131ED61A58F9027D06AC8F4E35D2A632BC6579F36C7A534DEDF44E57AC1C223E5C1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f442776555d943ec9c9e00b73faab890.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78037CIXfx7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.403269155402951
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmzTBVWAH1RD4d5WEV8iD:SbFuFyLVIg1BAf+MhV1VlSW88ajNTZD
MD5:	9D480229CBFF2B123508A9C050026FAC
SHA1:	2AF82E404F00AF5382DBDFEA4F0F2FFD81E281D1
SHA-256:	2198D532CBB0D8ED927AD0D855E03B0868CF6921870CE4ADE44A170BBE3A4E3D
SHA-512:	3D7AAF0B6516F0F9125FB947616CB1A8C2E284CB9C67A0DF20B1F34273884F0F0812962C6C0E5E58F80D2B3DAC766A33464EF0EE81C63186D535CAD887720858
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=92fd03f9b5704f078f6b3b93a0b9e027.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78138dYhRc9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.42496254451839
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuKe6gWA+sjswxJBpK:SbFuFyLVIg1BG+f+MuKe6gljLTTIWTIL
MD5:	031624712D602B54585B115B136B3AB8
SHA1:	C7A43A401036F8F8D8076EF4360F75E643668303
SHA-256:	256AF6234E894DEFA0B6A1FA7654204343BA099D3C347AE461B3EDA0BEC7AA81
SHA-512:	F0F4EF0BF08F53DDB936BB8A21187945B8877C0944EAAA4859E5C0C81B00E94CA4B53A16A487E567147925BAE1F8B5FF4C450628A161DEC7BFE287D2FF5AF3A1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da1d9f80d5e24b03b942757ebeda2031.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78169R37t68

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.444342875535398
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm5/NWRuXrBGnC0jk:SbFuFyLVK6g7/+BG+f+MlNWu30jNq
MD5:	04A7136D265D1DF89B49DD3E90E6EF6D
SHA1:	2DF550567CCCBA516A0841B8AD7087753E08D745
SHA-256:	FB19F8AA1360421A4E2C8946E3FAA209E77052E5DCC431FAE6D6F7CD401BC15D
SHA-512:	CA7EEBD8657F8A7554EAE72ACCA4015331FD9A29783925E3CE0F971AB7CD97976D393F941287A5E95AA33584E629F2BFA73113329114AD59AFC26C7A4295A560
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3275c723b67f43489532ec2dc9583a8e.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78170qr4HR7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.385948916828152
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm57Qa2UR9L0wsjsz:SbFuFyLVI6g7/+BG+f+Mu8R9QjNq
MD5:	3867F7DF7CC79319E8611580F6D3922E
SHA1:	8C435052703F63522C89C14D97226DAB9B5C8684
SHA-256:	AF4BD168FD744AA7C9B3442295DCCE3C0848F83F5EDCA43D5CB03C43A312E961
SHA-512:	9F7A3145B1DB79C597124B3D2100F4CD80364C08393D92996A3D9B8CBC686815A6E23389A92DDF264239B2D248A61D116AAC57765ABB02E540C7C19520830A0E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3a75d8b340744e9b806b0db8345e2532.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78196mXfAr8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.484498951859888
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mcf62sjFQMzKaBu:qgFqo6g7/+0+f+McPmTmh
MD5:	4637BD907148C2450434B2DCC9728221
SHA1:	2D0E1184567FDD227FB8546FAE7E2021B4DE0C79
SHA-256:	273EB69A167D2C57A3A0EBA072A88E20476D7ADFF22F5393B722AAD5E5784EB1
SHA-512:	1F85C08056D0487DF87EEE4CA7E30E01CE706A59E77C1AFAAF12883A8049AE629657CD5F9EC65C3E3833E829075907C734637A65E463862A62AA803358E6F8F0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ec99d60cbf04ee6afd9bc1167303617.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78197IbPgT5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.508524578324731
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MitOFrqjFQMzKaBu:qgFqdg7/+0+f+MyCr4Tmh
MD5:	8653A894FEB72AE624AF226D94AF99FE
SHA1:	F677CC90C175A6F50882892D5DFA9DE7CF6774F1
SHA-256:	EBCC39564FCC9C54763F9F0EE06984E2B1AC949B6689D5DD722283C95B6ECAB9
SHA-512:	84C7898D6927EC3385EA601F14544E5462C07F56637F814CE43E066647CC81FE1F9976C50F83E94DE7A7000EA756A3DD9FFF33E224E8F4E03267F1DC95D90782
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=777eb9ac1847447c821f400de757138c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:78609OOJb37

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.38033938562241
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuTwj0AGlHAvRxsjst:SbFuFyLVIg1BG+f+MuLHA5qjdCLKzK
MD5:	2A5862E85B99786186C495B3E1554441
SHA1:	BEC783E4821B28902119BAE574280EFF50793403
SHA-256:	C6FB13DF71040CD9DE45BBFAD1EB728CD0B4CAE1DBBCA17B423D882001DF9E14
SHA-512:	426B9C604179597D5E22130A813D3C67CA05F5BD12CD574894E023441617196AA8C5CB3B1D2E078D6596F4C82BB7639E150DD3F07C09B30ECD3600B9A2105049
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d2fe0258cf644a3d9aaae9c7b9b25eba.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78702Fo4S05

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.406176329467167
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm74QWwoWQAGWFsh+sd:SbFuFyLVIg1BG+f+MZWwL8WFATjosQu
MD5:	0F3EDC9255B278E5B429EF54D90EF1CA
SHA1:	9FA6FAE9B8A9C991E1C00CAFD1A9E3FFB3E86DD9
SHA-256:	332C54B8726B882CFA947AC869713959358B42645A6F72F3588733B3A9084720
SHA-512:	CD07075F31ABE2BEC4C1D388682FDFE9D024B924C3ABF938A324BC62C5DAFB80F9892AA825B3B0A02D387C21C66649844DD5B2E7A109B560D0237CBAC222A5EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e715c251eb34dc6a035ecefeba77482.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78927kBOKM7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.36074605273537
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu4c02RSSkUhjuGvXN:SbFuFyLVIg1BG+f+MuRNlFv8jLkGq
MD5:	18BF7D13AFB82BD5253897E927EA47B4
SHA1:	A2553345DB79BC6A6CC978D63302A77CA81A3DAA
SHA-256:	C74D24FC55AE4FC551C56BDEE38A9DDB269AF9C4FCEE717C96AB8250466213DA
SHA-512:	B42756DEBBD8C5E4AA62DC977288D61FF1CEC0867E207DE727DB75D391439DCDB06FDC62394BEDD123025E7E0D9EFD3801BC90640122B389D3985E57B9270526
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1ce8319a84547cfa5def1dec921aeec.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79407Iv7YG4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.356324492453907
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuPQAh/EWD1TjsmNzi:SbFuFyLVIg1BG+f+MuDEWDljdCLKzK
MD5:	93C9FD891291B12360BC24C3B7F85339
SHA1:	936224B6E12ADDB61FDE7680E9C053123D50375D
SHA-256:	26F9CA72FAE6B33BE382EEAA3E80E7E69B690DF6B96952BED74820096095C81D
SHA-512:	A81A3F71B43C113D18FA69D04B2F00CCA6732640C8E23D688740D3B5BAB49EF07BCBBB5ED6B18918DE153168CD1EF588C0922CABF25ADD174CC04480599C4478
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=db0b223ca81e46e5b77e7e3f3ea05f37.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79567mxDlV7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.442422053757987
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8egUTndIT1YgrqjosQu:qgFq6g10+f+M8egUTdITGgr4Qu
MD5:	63814EA52FEAAC9BA270FFEDB2F31D8E
SHA1:	FFE85362DF485B88D951943FEA0A1804EF5A1374
SHA-256:	6938799EE3D3CAD0C3255191D3FBB381881969D74EF9877DDA4638C0E7E04051
SHA-512:	993FFCBE62ED8E470D55F0F3E4C957CD6ACC3E2F11D727CBA73B0265CF5E3EE95471400A3DBE7891F735B94C444C86A32A93477C6CD121CC426F9E27C1169A17
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=606ec911603c4485b8b5f2983d9eaad7.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79573QFvUw8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.40362259069327
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmv1DAtvDdnvFlsjswK:SbFuFyLVIg1BG+f+MJy50jLkGq
MD5:	F3F5E41BEA4F26BCAC0F5429319A3BA4
SHA1:	54CE9AA941CE5637B2222DCC5831A9B7787D98C9
SHA-256:	7BA36DDE031259693A3D781C4D5CDB228725FEF7993E1263301E24A271795DC0
SHA-512:	8432E566F5C3D5EDCA6B520D1642C6959D7D0C3A16FFE65B54F29EA422D3374327C8C9C9FC756757B1A01CDF4C8393BEDD5B15EABF7005FD4B33D110C745505D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ebd32658de0e4345a2b62b2cbfa6e971.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79668WXrqd7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.413482909610781
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9frWHRScGEHYgjsmM:SbFuFyLVIg1BG+f+MQHlGE4gjdCLKzK
MD5:	92B28DCE5C96AF4CCE3BC352E398946D
SHA1:	0B2623B5C8971D4DA07ADF30D99A28529B380995
SHA-256:	8638C5FAD64F70A357DA4BB6D2FFC0210F6C453E9448C62632A15512BCAC3C09
SHA-512:	1016B0F2C41FF6C63A27115F572E3AFB593D60599A19E3D34B327D5551160F5EB67463F707EE46486F4CD1B33F5A5BB1EE9D5BA248F336D460324CB8FB0EA623
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b7490d3bc96479cab01f2dbd7a83485.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79796b1tPT8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.437359981620096
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MvzcdiWdz32jZcHcljX+:qgFq6g10+f+MNW9YmAu
MD5:	C6FA78881AC136D6169D03ACF9407650
SHA1:	35B4311C17532B547B00A7189D51D84E25563C01
SHA-256:	796387A7FCEF05B4AEAF87CE90BC5E19DF9090FBD30210DDDC51445C731BA943
SHA-512:	FA2FA520192DC3CED19176EC69935984404D758B8A4999AD5B8249346CF80DFA3B4E6CDF59BB65A3B44EF3B5B5400B75DAB2535AECB70BCA75AF8A80C6BFAA41
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9d538123d655431984a3a830adfae3df.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79892hF3cr6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.399953801607375
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6hZHAdwGDuBpBpjs2Ax:SbFuFyLVIg1BAf+M6rgaUubjNALyAZD
MD5:	439DEC04A5EC9A963F53C7A39CE4B938
SHA1:	053ED56B182923E2B02B8F404F2C32346C30700A
SHA-256:	8C8FEFD6A720ED614D854A0D8A28C5CF19304ACA5A8C01ED27BB49D62C6C2D42
SHA-512:	4D2C83874F264925318C76F6005821B0D6473EA65B20B5C33AA7FFB44337448C0A3B94326AE5E3A340815A9184E5A9A8E3BE15C1FD126181C8292AA2957B7713
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=077be9be8dcb4ef08b4d84fc94a82fde.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79968dxSND8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.487773477415858
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm71Tz7DGHKdcWA/sh+sA:SbFuFyLVIg1BAf+Ml/ddcfATjNdQIeXD
MD5:	5FD1AC6148D90B63D425EF0197FFC8B7
SHA1:	472E7457A51BF539323927B1148D8B8B8232F378
SHA-256:	FEB4173D60A90BFE8E4C153B4E0DFE62BFB3BD6D5EED1143D79B683F081AD897
SHA-512:	A5D4C06880C32E53B19B91295A679C34E3CDC9C53C51AE6822D51E287D867C441A52A372D71A4A563982187E0A709A0A458A3EC6FBCA6777A6E6FC72F9ED8E4D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=17c486f78e1748fcb5572d81d193e640.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81464GgdLtb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.562672166929002
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz6SkRLZcXsjs7LbgS:SbFuFyLVIg1BG+f+MmrFji4s
MD5:	56026C0BA83CE563C3290023210F0D0C
SHA1:	DF958C157AE0D9BC7E003FE24533604CBA3B0934
SHA-256:	DB52B56D094B6ADCD3C1C35AABEF57D5A6206030B0A05679CF2C900EFDF1FA83
SHA-512:	1ECAED1A3855AA808D9E58953EDF61781E5CA642E824B55391C722609D4D19FCABC4EB815511552374641248F25B2B56138DC1E63202871334FD5472BD272789
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=97149852ad38497d8ed46b058f527462.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81465utqcEb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.454252781714069
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6WzPp2dDQN2jZcHcljX+:qgFq6g10+f+MjxoCYmAu
MD5:	27B29AF45394C79A7504891CD3A42D19
SHA1:	839CDA9DE38D619C1D22B3DA1664C1447BED8A8F
SHA-256:	3E69367D13074F71F42BCFDBF6FD58808660C3C79151CD46FE3EF9E9EC369E16
SHA-512:	23843FEBA19A4BA18909C925247E124168927EA8DE8C2DA4BC159E9150AD542B7F6634DDD9788A6BD959875A4898A8EF7E0A22749849621FFC0B36E2933B8C03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0039a40f25cd4fd7b093ee700964f2f9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81540gOoSud

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.410645936217594
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8A8bDHlUqZswsjsmM:SbFuFyLVIg1BG+f+M8DhUqZsZjdCLKzK
MD5:	A299EB5C83EA0DD8EDF5814A87BCE305
SHA1:	8212ADC3097BD011E124A4F81F0085485BDEB4E1
SHA-256:	C50B824C11EFF0A545721875601622901C33F809B32125FE733F88E8325908F8
SHA-512:	6BFCE37E5CFE25720543804F81D1113ED5C30ED5DA1E995D81A608608F72B7D2F2E494459DA87F4F61D49A4BB0A92634E743C343CDC28A88CD3C1BA0A34122BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6e7376bd5f9f48f3a865bcfb7441e13c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81542q2BmWb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.404975121373026
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp2/FhmRL0hgrqjs16:SbFuFyLVIg1BG+f+MyscuqjosQu
MD5:	253A8E9BBE4F29FD742CE70169B68B0F
SHA1:	B7D80F3D86E8FD4424FAA1C37558D375FF8D8C07
SHA-256:	CD099353D7BC886AE6CAA49C3510A7752BB971114C08FB7D5B2585EF8E8366EF
SHA-512:	7C864BC35FF0B9A8C17CB3455E01A4401051573502B358727E8088DFD6A93DE53D6D59DC31C4E70D69BCF882A3311465FF72DF71671C8EBA024A665787DFDC60
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c9415afa34d74bcab0075b78ddd36cc9.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81556bxWO7b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.436524897487296
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm50IASWhJDEFEneATi:SbFuFyLVIg1BG+f+Mur2MTjZcHcljX+
MD5:	95C99FD04250F40058D4088E1D8470A7
SHA1:	E05D9F4A9E9EE855B7B8E54BC80588493139BD09
SHA-256:	EC00101E93E4461996AA2C7948A090A4FB31DD1E62FCF6633E9830130F1FF635
SHA-512:	C6C57524C9BD3C1DF88ACF795CDC86963D9F5CC60DB5A5926B4F50A4E6B003CE8079A667E7F123E3D5EAC4FF8378AFE6C382299AD3C89A81F60A5007CD8FACF2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=34f3573a1e734b53afcfafef3a0fc949.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81557SvsCna

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.441637243792434
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/jHMFR0Xglsjs2ALAXA:SbFuFyLVIg1BAf+MQt2jNALyAZD
MD5:	AD76A404CB00B8ED9E7A4D981E9AECB9
SHA1:	C06A33672383D8BAC015C5214639343641E00C34
SHA-256:	177CEEC943825FC7C17C0EB5E78039698F100BB54549E116E5B92FCD08D3B3A2
SHA-512:	A428D9EC3CE709E86BCCD3BF72C405E939A8FFA780EEAA700367E0AF944373566CE455B81A387FCC1B9E7215FF66601329C4DBC7086D83EDCD3E8B81AB5E5031
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ecbb968632644ea9493c4c4a7d9f9db.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81558qML5ke

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.393695035086199
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzzlJHRh5t6vsjswkT:SbFuFyLVIg1BG+f+MnHls0jLkGq
MD5:	ECD298201CC8914F1D0A90CB37EF05AC
SHA1:	EC4376C4B2EE65A221AE1C87AADFA7EA26BEE222
SHA-256:	92DB40133419F3C1D357F897809A1A0D175FEA122A5795EA6F41A2BA7BB2DDF9
SHA-512:	7A5C88DC0387E6CFBD25B941C848329CAD636B3AA591FE78A89EF8A6BE43E08682626F1AD8CF4F59DDE2DA643C6375D722D30E7B3C6AD67B09436E8E76687FD6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=95764fd19dc54d1e8f44f35e1aae3d4c.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:81559R4bu4a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.419695145773201
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmp4cRfnUtGUqswsjs2BI:SbFuFyLVIg1BAf+MbRfn8XZjNdQIeXD
MD5:	6EDC4DAE8C3CF819FE5C31DF6A99CA48
SHA1:	55F5CEE6B6ACBF9EF333AF8C814078DA66EFA37E
SHA-256:	0EF8AFFFD2C8259EF4355A314097EA652E3377FECF7544DC49C1A6E5D72492D5
SHA-512:	28A1064E5B50881F688B90C6211E21CFF928AC01301775E6C99639E7BB6C6992EA762E2F2C03E19387C5A0375EA00B70DEE55949EC23557408991384C1303524
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd0a9db2fa724d12a7bdc1aab32f69d3.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81650E2AlXa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.394012305956988
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6bnlcNBAswsjs2BZZGu:SbFuFyLVIg1BAf+M6bniNRjNTZD
MD5:	2CD099FE21E4ED8044EB1CA4D19260B1
SHA1:	3055CE8623EB1D1619A32149FF0DD4B2E4A5FEEB
SHA-256:	FEBC188FAF02F39F65208EB3741DC5A729F3D18D5DEE55C144B4A03A99F73D91
SHA-512:	5B3B59B501D25F07AF8B54D1942EA447D95C2A4BF1B88CD82A5103600F3D343785723FCC64E6289852C74DAE765140A44FCA684850DAE59476BB1178AFCDB3F9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=08d008fcab474c54b628da38cd5bab42.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81747lDh2md

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.379631161982492
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvE8c5T4GHU2pjswxM:SbFuFyLVIg1BG+f+MezjLTTIWTIL
MD5:	F81C29B766FE97E9DCD947BDD7FCF8AF
SHA1:	9CA962CB66EF2A9DF58701E98083C4051EF9FA32
SHA-256:	EEED40BB22309A20D54781E930403F532F739A3347984F90ADF0FA9F8A026DDB
SHA-512:	3A1F7F752057A4F48B939420221D1E4846E1A901BC0C554B8C8C3FBF42FF89C7FAE0FEEA2EF4F49E4D35ABF8537D2B0CA4E5ADBDEB66273486F0FD625DECB1EE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eda276ec9e984e81aaf360a2fc98109e.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81842jdibza

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.393126928434764
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4B00QWHw5aGUmEvsMqjbVC:qgFq6g10+f+M4B04HAOmEvsW
MD5:	30944F992DA22EF5BA60C925197A00FF
SHA1:	0D101A0C2F40AC04A0AEC4631B6AA594A9EA1FDB
SHA-256:	C8A38A8891FDDA882EB651B81F118508B0DB7002CC3A1433113FFFFD214CA4BF
SHA-512:	AA5F904E6C0CCB465DE3D37A8FE3D54F636D0B4391421790575A09ADA0BAB6F51E470DBF7102EFA8AA4C682F5133BD90EF40CD09287E866A6143040AA9CCA067
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2d7b51da533e431eb7c8edfce32c292a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:81885uWpx0a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.401959990886728
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4eTmdjHFrqjNq:qgFqo6g7/+0+f+M4hH+q
MD5:	B1875FB25ABDC0CD49E0DBEE628500B9
SHA1:	AEC728364114A71EBB34865B7155B708830F9282
SHA-256:	2EEF73392B30C756D5A5DB7E0CD6C66480A3B875339058EF0BE3A52608AB39EF
SHA-512:	031D21FADCC1AA5015F1ECE258531C150486501ED2EC494CE9281972BE100AE10856A24BF335D8E8CBD9D0C0DC73BAD932B2EA7EB5148B1ABB48429C8F1D6326
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2ebb6596646d42298d06ae79ff8f38da.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81887m8Nozb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3734901499416345
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmr/sqHyURUNrxsjk:SbFuFyLVI6g7/+BG+f+MnHRUNrqjNq
MD5:	FEFB8C77714BFF5D3F5F7C593F7D4AAF
SHA1:	EB9B12A5EA178E02293AC02BE4043025EC15E7EE
SHA-256:	0F653304BCB6D6A2CDCE980A651AC2E262054398F2E12517F5CF091E7637FD35
SHA-512:	CE5F0F2EB8E9E6CF87095EBB0986C3C54447C9D2837C740E73B5D7BF25C162C29B2BBE7C29A82B0354526A100E1F6D8D12E2FB4AC850B506E39C1A321A5E3D1E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a00ffaa119da4e7b9831e9ae6c377141.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81937jB0kzd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.516665082822572
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MoHmRnbH9hQ+N022jFQMzKaBu:qgFqo6g7/+0+f+MoGZbH9hQANETmh
MD5:	1A645194594EC010CC21B0FC1B57CA40
SHA1:	8890D829B2A02ACB6FF867F9BF112D18702EA6E7
SHA-256:	B95A536E0ABE34BF5450B3AC96969E8D3C913469F2BF9180ED2018B445FA0431
SHA-512:	179771D5DA5A126303EB4853947C178731AB70546C28BFBBE4693EEBF56438E1C462E46A66576D538F0455F7B305FA89613029962936611608BEB38B5DC21723
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bb3bf474a99545bb9c9dee3bd5120028.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:819438MlOse

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.505957225320254
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8HW1cGmxGBKsZjFQMzKaBu:qgFqdg7/+0+f+M821xCGI2Tmh
MD5:	1B257B9541AF448B5659AA849FDD56A7
SHA1:	07FF22962B0B7E74FCA0BA3793DAA86555ADE97F
SHA-256:	8D6C4F273894511695A0FD5DC9C6D3C540FB3D48E93B2B0929E17AD327D0F3E0
SHA-512:	47863FE1A55D5C538AAEAA15D752B8AC3197B3961AEE3422FC28065B74BA479556BD2FD757B0E2C011CCD407F5AE767222D7FD4AD2F25CC2A67891510868CF2E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6b35cbd9270a41938b9c2a44cd44210d.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat0Nek7Ov

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0PuH6ZG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0SYJWIf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0TFTOJ5

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0mbcwst

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0nml4cz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0w5GbKE

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0waDEpf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1270G3imI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293626307788637
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8nzgrFIn2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEnzg22thQHtPYq9M
MD5:	8884B72A96AC9D6866913849495C4BAA
SHA1:	D4D08A7DE1D1F1FCE97FD10DCD3BAC34D2D9F95C
SHA-256:	C1454E6D53753F3DD8EAA242F155BAA8FA1AD4F0D2BE6DFE22BD29869A18D8DF
SHA-512:	3CC2F4E9A92F54D950A2ADCB31C8895C2DB01A629686727BCD85F67E0A4F270346D9220016A4EE22C24A51E841EC35622D416DBF120CEBE4DBBD9BFDE4E666E7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14442.REALTIME=1733687434272633.MONOTONIC=580142354.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1279dRJVG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3369558741880425
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGRSkXkIW/7Ei5206qodj+:SbFuFyL3BVgdL87iesnAiRJgrFI4t6s
MD5:	850AAC58D79FCCFF4A97F9375C2A1A07
SHA1:	8E195038B3D530F97786A9406CE7E6FB9D286940
SHA-256:	9FA39BD60A4A1AACAA14E2595389D1E208E3632D91FEA6C883A3E2EBDA35854A
SHA-512:	448D7EF5C45B96514E7D31458A2CF21A0445747900C36340649DBC806880F2B287798FA791912AAE7EB1DD4CF69ACB7D657D585EADC8C2A3A54C3C84A7B150DD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733687434272633.MONOTONIC=580142354.LAST_SESSION_TIMESTAMP=580208890.

/run/systemd/users/.#127Nmaw1e

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.307456572079027
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgrwWu02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJghuPthQHtPYq9M
MD5:	9265BF35BDB486F23347BE0D76447F5B
SHA1:	4D7A6BE952D166401ACF93EDF1D6A5CFECE6F466
SHA-256:	65914CB57D45D2DCFEB10BD3BE26794DAEF07CAFD90E618268059B5CB7DAE41E
SHA-512:	4D3B78C4FD0B95B33686555A70A075403D8143EC335040D4640E84D2581349906802541E32A9FEBD8842171272EB355FAC88B3A8E251FB1C08CEDC967D0EDA4F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733687333429915.MONOTONIC=479299635.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127QKXB3c

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Wu3P6H

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.492980227963834
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8SgxJgrFI4t6s:qgFq30dABibBE5Tg24Is
MD5:	5406ED5EE01B4A15A15E1089B5E409D9
SHA1:	7B9B73EFF08DB5D2E1437A9402B5EFCE831413AF
SHA-256:	7F23B321A6A120FE10446AA158AEA46C8EAAD682D964F76832E362E3CB8F4B86
SHA-512:	E1C54B4D0261CB01F7F4194048FEF623309D23E53FB1F03D36AF6C565FF325D95CD3ED230FF8BE77F21FD7E09FE868CC6FB33899EBA81056DEEE0ED0A1433CA7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14624.REALTIME=1733687434272633.MONOTONIC=580142354.LAST_SESSION_TIMESTAMP=580208890.

/run/systemd/users/.#127XDxItv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.321123187394
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGRS8Er52cxSXeDi206qodqlTn:SbFuFyL3BVgdL87iesnAiRJgr8Er0DX3
MD5:	EB994763F03BB2C5B53A6717F4DA7238
SHA1:	63F454B98E36513369DCEA37CC875B2D5E1F2225
SHA-256:	2F5CC290E848A18B2829BCF9CFE7284F1B22D84FF4027C99AFCE73F360D8C3DE
SHA-512:	5AAB11F28FA3C271474BE9DFE24235F765204DB538F1176B3E3723A1A89ACFB89FA40DCA5A736CDDBD23F881EC0A114D25FB839F196810370F4A8D2D98A8CE43
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733687373224009.MONOTONIC=519093729.LAST_SESSION_TIMESTAMP=519178908.

/run/systemd/users/.#127bRT1aJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127dPVhNv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.304928048950669
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff4Jgr8Er0DXeN2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBgJgtr6XekthQHtPYb
MD5:	71521B9F31436A65E0A46E76C7A993D2
SHA1:	9D3BF2FD4C51E7B767370D3ABB1EDA881974354A
SHA-256:	CB1C2922947C879289FF169BF3FFB3440F8FAB29503DC0FBFB550853FFEFA62E
SHA-512:	D9F279EFA3020D5440A8004DD5E30D0BE992BEB8599BEACCE6B1941A3166DD7C67A03FD83B54E569F104EA1560C069A2AF51FB5082EF4F4C3BDD9AA2A76EEBE5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13825.REALTIME=1733687373224009.MONOTONIC=519093729.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127dRBClw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127eheB0G

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.293626307788637
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8nzgrFIn2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEnzg22thQHtPYq9M
MD5:	8884B72A96AC9D6866913849495C4BAA
SHA1:	D4D08A7DE1D1F1FCE97FD10DCD3BAC34D2D9F95C
SHA-256:	C1454E6D53753F3DD8EAA242F155BAA8FA1AD4F0D2BE6DFE22BD29869A18D8DF
SHA-512:	3CC2F4E9A92F54D950A2ADCB31C8895C2DB01A629686727BCD85F67E0A4F270346D9220016A4EE22C24A51E841EC35622D416DBF120CEBE4DBBD9BFDE4E666E7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14442.REALTIME=1733687434272633.MONOTONIC=580142354.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127gArnPt

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.304928048950669
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff4Jgr8Er0DXeN2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBgJgtr6XekthQHtPYb
MD5:	71521B9F31436A65E0A46E76C7A993D2
SHA1:	9D3BF2FD4C51E7B767370D3ABB1EDA881974354A
SHA-256:	CB1C2922947C879289FF169BF3FFB3440F8FAB29503DC0FBFB550853FFEFA62E
SHA-512:	D9F279EFA3020D5440A8004DD5E30D0BE992BEB8599BEACCE6B1941A3166DD7C67A03FD83B54E569F104EA1560C069A2AF51FB5082EF4F4C3BDD9AA2A76EEBE5
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13825.REALTIME=1733687373224009.MONOTONIC=519093729.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127iM9Bdf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.304476078473082
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGRSwR/e4Si2g206qodPPvn:SbFuFyL3BVgdL87iesnAiRJgrwWVgt6F
MD5:	F13E64786BEB49D55D20CA741739D252
SHA1:	183544A653E9BCB40C667CAFE9AE562B114DC190
SHA-256:	44BAC5A9D77F62FAAC8C59AFECB4766FA47B61E80DBBE9AD5B3982AE5B7E60C3
SHA-512:	DDCD3A6D2B4EDA103EAB2B5BDBB82D00C7E20DD28AE17ABC1D5B850A9051F38CA81CABDBED37DFCBE7E0B56CCB301F1EA3B702273647DB7533A2A7794F0325D4
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733687333429915.MONOTONIC=479299635.LAST_SESSION_TIMESTAMP=479381661.

/run/systemd/users/.#127sYnIiH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.492980227963834
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8SgxJgrFI4t6s:qgFq30dABibBE5Tg24Is
MD5:	5406ED5EE01B4A15A15E1089B5E409D9
SHA1:	7B9B73EFF08DB5D2E1437A9402B5EFCE831413AF
SHA-256:	7F23B321A6A120FE10446AA158AEA46C8EAAD682D964F76832E362E3CB8F4B86
SHA-512:	E1C54B4D0261CB01F7F4194048FEF623309D23E53FB1F03D36AF6C565FF325D95CD3ED230FF8BE77F21FD7E09FE868CC6FB33899EBA81056DEEE0ED0A1433CA7
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14624.REALTIME=1733687434272633.MONOTONIC=580142354.LAST_SESSION_TIMESTAMP=580208890.

/run/systemd/users/.#127wFK9ou

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.472021580314885
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixffy5Jgr8Er0DXeWt6slT:qgFq30dABibBgJgtr6XeWIG
MD5:	3C3FE1D2551C7BB756690EB8B5C81CAE
SHA1:	F84CD68FF4E726CD37DA137AADCECF2682B8B786
SHA-256:	3F48D00DC43003D1BF1772C8C1D41EF9D12004D9ABFB1018E5A2247712BCAED6
SHA-512:	784C9DE50632028C72AE21676ACD74D4A386F2800E4B4079CD0679A344B1CF2C9F0D2F0446173AC5C1BB5C33E7E908C599EE1DEE55A10D68034B78EB35C0C89C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13887.REALTIME=1733687373224009.MONOTONIC=519093729.LAST_SESSION_TIMESTAMP=519178908.

/run/systemd/users/.#127x17GId

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.307456572079027
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgrwWu02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJghuPthQHtPYq9M
MD5:	9265BF35BDB486F23347BE0D76447F5B
SHA1:	4D7A6BE952D166401ACF93EDF1D6A5CFECE6F466
SHA-256:	65914CB57D45D2DCFEB10BD3BE26794DAEF07CAFD90E618268059B5CB7DAE41E
SHA-512:	4D3B78C4FD0B95B33686555A70A075403D8143EC335040D4640E84D2581349906802541E32A9FEBD8842171272EB355FAC88B3A8E251FB1C08CEDC967D0EDA4F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733687333429915.MONOTONIC=479299635.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127ypwdKu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.472021580314885
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixffy5Jgr8Er0DXeWt6slT:qgFq30dABibBgJgtr6XeWIG
MD5:	3C3FE1D2551C7BB756690EB8B5C81CAE
SHA1:	F84CD68FF4E726CD37DA137AADCECF2682B8B786
SHA-256:	3F48D00DC43003D1BF1772C8C1D41EF9D12004D9ABFB1018E5A2247712BCAED6
SHA-512:	784C9DE50632028C72AE21676ACD74D4A386F2800E4B4079CD0679A344B1CF2C9F0D2F0446173AC5C1BB5C33E7E908C599EE1DEE55A10D68034B78EB35C0C89C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13887.REALTIME=1733687373224009.MONOTONIC=519093729.LAST_SESSION_TIMESTAMP=519178908.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:kF:kF
MD5:	D8ADE117A689532C3349F5BB1445A9B1
SHA1:	372059BDFA63D139EA3ECCDDB6498C365F392E69
SHA-256:	A706293DFC8876A67112C306ED659F7A81F8CE7A2509ACE099A2C98CD736529C
SHA-512:	BE97DE4C46580BD2ACAE574E1FCB08374A17FED7F7310FB03A99AD0D2782071F2CD87BFF9909FA93C98CB5ACCC853754FBC525BA10D991CC61DFE1CF28D404A8
Malicious:	false
Preview:	6500.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nXn:X
MD5:	B50062474DE644849FFFD35B154DD1D5
SHA1:	440E5E307FDD02A631727163929E44E279BF49CF
SHA-256:	8562DB7F9631EC4394DBFACAC8FEF9B8BD4F6079ACFE4E371785AFFC5C8BCCE9
SHA-512:	7FA2D75591F6915101F72F38191ACF24EB3DDB4DC8590C691C848E12E11B1A58F73D2B19865FF94777D0A15061BFA376BD050C4B6231E81C55749B9DD379D35B
Malicious:	false
Preview:	7113.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6690526996386923
Encrypted:	false
SSDEEP:	3:vRc1sXlXEWtl/Gy3b1:vRv+yl
MD5:	7C186BAF41DC827B118A4E390C0A1EB6
SHA1:	9C6BAC4CB77B0DB406D94D24E546064BC8DE102D
SHA-256:	DC187CBAA07DD5D1F663A9D5C8A6B46547A7C48AAF06CF612B42EB578BA782B7
SHA-512:	B2C382DBEFA1C20DA3A7E4154899C781FD3BE1A1387283E21FC84C65A726BAF89CDC73681B629E97D6C2A107CB163038DAD544C3285A1C817DE4E928878EB596
Malicious:	false
Preview:	....=...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................=...y.UgQ.......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nVn:V
MD5:	F4A176795176F96BAEB9D95941B61769
SHA1:	F9C2C15DCC87D632476B168302E14A3394F21F97
SHA-256:	3573D61E6CA4FBA8D4C3486BC715745F844F3C1E2BAEFD4F64E4FDDB17016345
SHA-512:	DAF4DE51CB2184916B00E9C72FD3BB43B0CF4418B77A93E189E793770A300A085348ED52E7B3B1F3459EB690D9C9BE8A76CAAF2C83F718E5127A68562476866C
Malicious:	false
Preview:	7119.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nAn:An
MD5:	46DA04015F314617B4027E7077098D7D
SHA1:	AB3D1EBF2CE56D816AD7A758F478505C3464C797
SHA-256:	206C5CF8B9DAA8117091F111423C921EEA576867532EDEDE6132544D702D6111
SHA-512:	817A39EB59509AA4EFBEA2E698211FCF7574D99F58319318222B6A3B289051D382E9FE6014646B612EBCDD6316C6CEB5C7496D0E067791BEC6645A46EB962B65
Malicious:	false
Preview:	7112.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:mcQKWn:mcQKW
MD5:	221072F410E1076569E697D1F298583A
SHA1:	413D5E05E7D9B3F401145829435695C47530009F
SHA-256:	65A7B22C2B17D59E164E6023A8DDFF8D868731F5311F0194DF07D826159F7233
SHA-512:	3DCC8DD717616D70F55F231803F66DD801A3FE6EE9D891C3A97AD0947D28D43B8A152CEFA14B640C1B250E275CAC820071879F274DD450FD2F449C69411E94DB
Malicious:	false
Preview:	7095.7096.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nXn:X
MD5:	B50062474DE644849FFFD35B154DD1D5
SHA1:	440E5E307FDD02A631727163929E44E279BF49CF
SHA-256:	8562DB7F9631EC4394DBFACAC8FEF9B8BD4F6079ACFE4E371785AFFC5C8BCCE9
SHA-512:	7FA2D75591F6915101F72F38191ACF24EB3DDB4DC8590C691C848E12E11B1A58F73D2B19865FF94777D0A15061BFA376BD050C4B6231E81C55749B9DD379D35B
Malicious:	false
Preview:	7113.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nVn:V
MD5:	F4A176795176F96BAEB9D95941B61769
SHA1:	F9C2C15DCC87D632476B168302E14A3394F21F97
SHA-256:	3573D61E6CA4FBA8D4C3486BC715745F844F3C1E2BAEFD4F64E4FDDB17016345
SHA-512:	DAF4DE51CB2184916B00E9C72FD3BB43B0CF4418B77A93E189E793770A300A085348ED52E7B3B1F3459EB690D9C9BE8A76CAAF2C83F718E5127A68562476866C
Malicious:	false
Preview:	7119.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nAn:An
MD5:	46DA04015F314617B4027E7077098D7D
SHA1:	AB3D1EBF2CE56D816AD7A758F478505C3464C797
SHA-256:	206C5CF8B9DAA8117091F111423C921EEA576867532EDEDE6132544D702D6111
SHA-512:	817A39EB59509AA4EFBEA2E698211FCF7574D99F58319318222B6A3B289051D382E9FE6014646B612EBCDD6316C6CEB5C7496D0E067791BEC6645A46EB962B65
Malicious:	false
Preview:	7112.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.5219280948873624
Encrypted:	false
SSDEEP:	3:mcQKWn:mcQKW
MD5:	221072F410E1076569E697D1F298583A
SHA1:	413D5E05E7D9B3F401145829435695C47530009F
SHA-256:	65A7B22C2B17D59E164E6023A8DDFF8D868731F5311F0194DF07D826159F7233
SHA-512:	3DCC8DD717616D70F55F231803F66DD801A3FE6EE9D891C3A97AD0947D28D43B8A152CEFA14B640C1B250E275CAC820071879F274DD450FD2F449C69411E94DB
Malicious:	false
Preview:	7095.7096.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:nXn:X
MD5:	B50062474DE644849FFFD35B154DD1D5
SHA1:	440E5E307FDD02A631727163929E44E279BF49CF
SHA-256:	8562DB7F9631EC4394DBFACAC8FEF9B8BD4F6079ACFE4E371785AFFC5C8BCCE9
SHA-512:	7FA2D75591F6915101F72F38191ACF24EB3DDB4DC8590C691C848E12E11B1A58F73D2B19865FF94777D0A15061BFA376BD050C4B6231E81C55749B9DD379D35B
Malicious:	false
Preview:	7113.

/var/lib/AccountsService/users/gdm.0NMKY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.LVVFY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.NUXEY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	4.901206106385457
Encrypted:	false
SSDEEP:	24:6RZeaevGeDuEbJkAvWkA2+V4pER0pYrRJrbD:7vafVYYrvrbD
MD5:	E64491AD292F2F1AD363557282AF372A
SHA1:	2360DCB445F040CDBDB57BE53333D50A2364552C
SHA-256:	FE1FB69B3108E3471877AA0C8FE7E6CF8D3D85A6827B2DD69759DCA12D6DDEDC
SHA-512:	B729F64D47D7228FC4C83C87475375DCF70F68BFFAB64F75906CBEA25F3DFD2EB44D410D0387FF0C08A945E4F4176B0972CAF6E099C8488807507684961FF6C9
Malicious:	false
Preview:	Dec 8 13:50:20 galassia systemd-logind[6976]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 8 13:50:20 galassia systemd-logind[6976]: User enumeration failed: Invalid argument.Dec 8 13:50:20 galassia systemd-logind[6976]: User of session 2 not known..Dec 8 13:50:20 galassia systemd-logind[6976]: Session enumeration failed: No such file or directory.Dec 8 13:50:20 galassia systemd-logind[6976]: Watching system buttons on /dev/input/event0 (Power Button).Dec 8 13:50:20 galassia systemd-logind[6976]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 8 13:50:20 galassia systemd-logind[6976]: New seat seat0..Dec 8 13:50:34 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 8 13:50:34 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 8 13:50:34 galassia systemd-logind[6976]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.448047321524811
Encrypted:	false
SSDEEP:	3:F31Hld31jrZpIctlt31jrZpIc/:F391jrZm0ld1jrZm
MD5:	10DD96332CDF0829A99960AAB4ACA230
SHA1:	5BEB4E0C5AF8F2F04CB93646D4A08AB9E29A6242
SHA-256:	B4E3CC9F3D55F3C28FD021E23066228F59DC21D4E0282F4B0F3B1627F1230856
SHA-512:	CAE46E5CE97E1D03771A297F8D709E180CF38BFF8223B66E042C23CDB5CF09D5C5D7E95930E30EA2A60030BD66DF9CC9CEC984AD144B9F2276C306AF6080F824
Malicious:	false
Preview:	LPKSHHRH.................7.L.FN#.......$.................................7.L.FN#.......$........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlelUJflUJ:F3qm
MD5:	1B54EDFA1F361978B29057C675249891
SHA1:	7C6CFC9FDC2FAA5CE346C29FDC2382F470F5BB85
SHA-256:	0DC80CE6F23972339B9B64B52CDBA716EB61785610B87D10B660C9F13789757D
SHA-512:	261C3A1EC3C6B8476AEBD5097266D74437AED57DFF92EBCA00A0BD7A74341DF7F8E34F3AB5C2B289243CB8D8CF948766AF8A4BDEF7B435DCE67840249CFF635D
Malicious:	false
Preview:	LPKSHHRH................Xk%...M).....q`.................................Xk%...M).....q`.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	4.932165709269425
Encrypted:	false
SSDEEP:	192:UpnkZKEXkmD50xAKq3omtr8Zh8MBp0ZCrTPz:udVq3om5wL
MD5:	61A04314886C153F2BD4A73935281F20
SHA1:	475AC7B6C215AC44164939842133836890386310
SHA-256:	6589E10C4FFA2AA552E1C0B53B898938B49E495324FE425F804190E94FB30C6E
SHA-512:	33F2F12C41EF1CB318CE8695A8EF82C8EBDB70131DEE6D331EFBC2E536E61FCC762B6D0CE63C26CFFE9045D286D7EF2F75CC106011154F90321D502535454B85
Malicious:	false
Preview:	Dec 8 13:50:11 galassia kernel: [ 552.496244] blocking signal 9: 6242 -> 2048.Dec 8 13:50:11 galassia kernel: [ 556.970918] blocking signal 9: 6242 -> 658.Dec 8 13:50:11 galassia kernel: [ 556.974889] blocking signal 9: 6242 -> 720.Dec 8 13:50:11 galassia kernel: [ 556.980680] blocking signal 9: 6242 -> 772.Dec 8 13:50:11 galassia kernel: [ 556.986103] blocking signal 9: 6242 -> 936.Dec 8 13:50:11 galassia kernel: [ 556.988923] blocking signal 9: 6242 -> 2048.Dec 8 13:50:11 galassia kernel: [ 557.569156] New task spawned: old: (tgid 6999, tid 6999), new (tgid: 6999, tid: 7037).Dec 8 13:50:11 galassia kernel: [ 557.569290] New task spawned: old: (tgid 6999, tid 6999), new (tgid: 6999, tid: 7038).Dec 8 13:50:12 galassia kernel: [ 557.582993] New task spawned: old: (tgid 6999, tid 7038), new (tgid: 6999, tid: 7039).Dec 8 13:50:12 galassia kernel: [ 557.844150] New task spawned: old: (tgid 6991, tid 6991), new (tgid: 6991, tid: 7040).Dec 8 13:50:13 galassia kernel: [

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	28719
Entropy (8bit):	5.088375950311398
Encrypted:	false
SSDEEP:	768:Wp8QpCYseaYseLraL/RGwEqO4MujmyDXVqrBLRdLWGqGwouq4rrZr9r/rr:oXrps5Vxj3
MD5:	C0BB11942B8952934CAD999401CC9CB9
SHA1:	450D1A04F65423F6053EE6EA78E5B2D0BA35E1B2
SHA-256:	BF3B37ADEAB026C04F44CE442211C2F0E864F22065A2C2C45009F693FF676466
SHA-512:	E75604B9C9031542133E7ABF6EF27087323876081D72D351B917A83D837773A8B72925BF7D58420227E8B46BA5B4DFBB6271C4CA21A708B526EB0939AB2ECA35
Malicious:	false
Preview:	Dec 8 13:50:11 galassia kernel: [ 552.496244] blocking signal 9: 6242 -> 2048.Dec 8 13:50:11 galassia kernel: [ 556.909274] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 8 13:50:11 galassia kernel: [ 556.909282] systemd[1]: Stopped Journal Service..Dec 8 13:50:11 galassia kernel: [ 556.910459] systemd[1]: Starting Journal Service....Dec 8 13:50:11 galassia kernel: [ 556.912413] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 8 13:50:11 galassia kernel: [ 556.912416] systemd[1]: dbus.service: Failed with result 'signal'..Dec 8 13:50:11 galassia kernel: [ 556.917809] systemd[1]: Started D-Bus System Message Bus..Dec 8 13:50:11 galassia kernel: [ 556.948155] systemd[1]: getty@tty2.service: Succeeded..Dec 8 13:50:11 galassia kernel: [ 556.948870] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 6..Dec 8 13:50:11 galassia kernel: [ 556.948877] systemd[1]: Stopped Getty o

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6690526996386923
Encrypted:	false
SSDEEP:	3:vRc1sXlXEWtl/Gy3b1:vRv+yl
MD5:	7C186BAF41DC827B118A4E390C0A1EB6
SHA1:	9C6BAC4CB77B0DB406D94D24E546064BC8DE102D
SHA-256:	DC187CBAA07DD5D1F663A9D5C8A6B46547A7C48AAF06CF612B42EB578BA782B7
SHA-512:	B2C382DBEFA1C20DA3A7E4154899C781FD3BE1A1387283E21FC84C65A726BAF89CDC73681B629E97D6C2A107CB163038DAD544C3285A1C817DE4E928878EB596
Malicious:	true
Preview:	....=...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................=...y.UgQ.......................................

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:52674 -> 178.215.238.4:33966

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.9418959581816235
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	wnbw86.elf
File size:	116'588 bytes
MD5:	5f33f958945dce126f4f18ee23b09162
SHA1:	11bb26bd016673b201bf56c61087e6727736a971
SHA256:	ae156529ee59ea9218d3bbb7760d536e8becff7ff55659f9b723fcdfb1fa7726
SHA512:	e96b2b90261b4d7eeb16f9698c83a920a43853cd5d7cff7aae8d2a03fd5e88f7a344437740e6efe22cf789cd9ca29e05328673f49527643a2c13dc0ceb250ef3
SSDEEP:	3072:qQqD7K0a4sqPEd6WN4GITR+c7NIAhL2DsPcQsiM:3qXKz45q6WNBAl+kcQPM
TLSH:	5FB37CC4F243E4F5E86301706037FB379B32E4795129EA43D7A5AD36ACA2641DA0BA5C
File Content Preview:	.ELF....................d...4...........4. ...(......................~...~...............~...........G..............Q.td............................U..S............h.....P..[]...$.............U......=.U...t..5....D......D.......u........t....h............

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048164
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	116188
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x15116	0x0	0x6	AX	16
.fini	PROGBITS	0x805d1c6	0x151c6	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805d1e0	0x151e0	0x2c33	0x0	0x2	A	32
.ctors	PROGBITS	0x8060e18	0x17e18	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x8060e24	0x17e24	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8060e40	0x17e40	0x475c	0x0	0x3	WA	32
.bss	NOBITS	0x80655a0	0x1c59c	0x492c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1c59c	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x17e13	0x17e13	6.5917	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x17e18	0x8060e18	0x8060e18	0x4784	0x90b4	0.3806	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 8, 2024 20:48:38.361443043 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 8, 2024 20:49:58.371155977 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 8, 2024 20:47:48.092278004 CET	192.168.2.23	8.8.8.8	0x94d5	Standard query (0)	raw.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Dec 8, 2024 20:47:48.338728905 CET	192.168.2.23	8.8.8.8	0xdf7e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 8, 2024 20:47:48.460935116 CET	192.168.2.23	8.8.8.8	0xdf7e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 8, 2024 20:47:48.583096981 CET	192.168.2.23	8.8.8.8	0xdf7e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 8, 2024 20:47:48.706525087 CET	192.168.2.23	8.8.8.8	0xdf7e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 8, 2024 20:47:48.829380989 CET	192.168.2.23	8.8.8.8	0xdf7e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	484	false
Dec 8, 2024 20:47:50.968642950 CET	192.168.2.23	8.8.8.8	0x50ea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	487	false
Dec 8, 2024 20:47:51.097661972 CET	192.168.2.23	8.8.8.8	0x50ea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	487	false
Dec 8, 2024 20:47:51.377676964 CET	192.168.2.23	8.8.8.8	0x50ea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	487	false
Dec 8, 2024 20:47:51.499634027 CET	192.168.2.23	8.8.8.8	0x50ea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	487	false
Dec 8, 2024 20:47:51.622354984 CET	192.168.2.23	8.8.8.8	0x50ea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	487	false
Dec 8, 2024 20:47:53.750123978 CET	192.168.2.23	8.8.8.8	0x8e40	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 8, 2024 20:47:53.873357058 CET	192.168.2.23	8.8.8.8	0x8e40	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	489	false
Dec 8, 2024 20:47:53.995969057 CET	192.168.2.23	8.8.8.8	0x8e40	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	490	false
Dec 8, 2024 20:47:54.126059055 CET	192.168.2.23	8.8.8.8	0x8e40	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	490	false
Dec 8, 2024 20:47:54.255026102 CET	192.168.2.23	8.8.8.8	0x8e40	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	490	false
Dec 8, 2024 20:47:56.386274099 CET	192.168.2.23	8.8.8.8	0x3987	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	492	false
Dec 8, 2024 20:47:56.510653973 CET	192.168.2.23	8.8.8.8	0x3987	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	492	false
Dec 8, 2024 20:47:56.633641005 CET	192.168.2.23	8.8.8.8	0x3987	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	492	false
Dec 8, 2024 20:47:56.755724907 CET	192.168.2.23	8.8.8.8	0x3987	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	492	false
Dec 8, 2024 20:47:56.881382942 CET	192.168.2.23	8.8.8.8	0x3987	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	492	false
Dec 8, 2024 20:47:59.029299021 CET	192.168.2.23	8.8.8.8	0xe070	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	495	false
Dec 8, 2024 20:47:59.153307915 CET	192.168.2.23	8.8.8.8	0xe070	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	495	false
Dec 8, 2024 20:47:59.281709909 CET	192.168.2.23	8.8.8.8	0xe070	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	495	false
Dec 8, 2024 20:47:59.403937101 CET	192.168.2.23	8.8.8.8	0xe070	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	495	false
Dec 8, 2024 20:47:59.528047085 CET	192.168.2.23	8.8.8.8	0xe070	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	495	false
Dec 8, 2024 20:48:01.672832012 CET	192.168.2.23	8.8.8.8	0x252c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	497	false
Dec 8, 2024 20:48:01.796134949 CET	192.168.2.23	8.8.8.8	0x252c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	497	false
Dec 8, 2024 20:48:01.925072908 CET	192.168.2.23	8.8.8.8	0x252c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	497	false
Dec 8, 2024 20:48:02.052526951 CET	192.168.2.23	8.8.8.8	0x252c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	498	false
Dec 8, 2024 20:48:02.174774885 CET	192.168.2.23	8.8.8.8	0x252c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	498	false
Dec 8, 2024 20:48:04.312628984 CET	192.168.2.23	8.8.8.8	0x8ef4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	500	false
Dec 8, 2024 20:48:04.435075998 CET	192.168.2.23	8.8.8.8	0x8ef4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	500	false
Dec 8, 2024 20:48:04.557363033 CET	192.168.2.23	8.8.8.8	0x8ef4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	500	false
Dec 8, 2024 20:48:04.681030989 CET	192.168.2.23	8.8.8.8	0x8ef4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	500	false
Dec 8, 2024 20:48:04.807507038 CET	192.168.2.23	8.8.8.8	0x8ef4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	500	false
Dec 8, 2024 20:48:07.097104073 CET	192.168.2.23	8.8.8.8	0x1758	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	503	false
Dec 8, 2024 20:48:07.219369888 CET	192.168.2.23	8.8.8.8	0x1758	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	503	false
Dec 8, 2024 20:48:07.341726065 CET	192.168.2.23	8.8.8.8	0x1758	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	503	false
Dec 8, 2024 20:48:07.464232922 CET	192.168.2.23	8.8.8.8	0x1758	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	503	false
Dec 8, 2024 20:48:07.587150097 CET	192.168.2.23	8.8.8.8	0x1758	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	503	false
Dec 8, 2024 20:48:37.426603079 CET	192.168.2.23	1.1.1.1	0x2ae0	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 20:48:37.426640034 CET	192.168.2.23	1.1.1.1	0xd37b	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 8, 2024 20:48:38.053394079 CET	192.168.2.23	1.1.1.1	0x952d	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 8, 2024 20:49:01.291299105 CET	192.168.2.23	1.1.1.1	0xcc36	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 8, 2024 20:49:15.761678934 CET	192.168.2.23	1.1.1.1	0x2309	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 8, 2024 20:49:25.405843019 CET	192.168.2.23	8.8.8.8	0xdc77	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	325	false
Dec 8, 2024 20:49:25.534889936 CET	192.168.2.23	8.8.8.8	0xdc77	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	325	false
Dec 8, 2024 20:49:25.657565117 CET	192.168.2.23	8.8.8.8	0xdc77	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	325	false
Dec 8, 2024 20:49:25.779812098 CET	192.168.2.23	8.8.8.8	0xdc77	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	325	false
Dec 8, 2024 20:49:25.904695988 CET	192.168.2.23	8.8.8.8	0xdc77	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	325	false
Dec 8, 2024 20:49:28.155996084 CET	192.168.2.23	8.8.8.8	0x5d8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 8, 2024 20:49:28.278130054 CET	192.168.2.23	8.8.8.8	0x5d8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 8, 2024 20:49:28.400228024 CET	192.168.2.23	8.8.8.8	0x5d8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 8, 2024 20:49:28.522825003 CET	192.168.2.23	8.8.8.8	0x5d8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 8, 2024 20:49:28.645031929 CET	192.168.2.23	8.8.8.8	0x5d8c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	328	false
Dec 8, 2024 20:49:30.785293102 CET	192.168.2.23	8.8.8.8	0x87d4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	330	false
Dec 8, 2024 20:49:30.911099911 CET	192.168.2.23	8.8.8.8	0x87d4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	330	false
Dec 8, 2024 20:49:31.038209915 CET	192.168.2.23	8.8.8.8	0x87d4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false
Dec 8, 2024 20:49:31.166568041 CET	192.168.2.23	8.8.8.8	0x87d4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false
Dec 8, 2024 20:49:31.288767099 CET	192.168.2.23	8.8.8.8	0x87d4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	331	false
Dec 8, 2024 20:49:33.411516905 CET	192.168.2.23	8.8.8.8	0xd60b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	333	false
Dec 8, 2024 20:49:33.534132957 CET	192.168.2.23	8.8.8.8	0xd60b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	333	false
Dec 8, 2024 20:49:33.662913084 CET	192.168.2.23	8.8.8.8	0xd60b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	333	false
Dec 8, 2024 20:49:33.785141945 CET	192.168.2.23	8.8.8.8	0xd60b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	333	false
Dec 8, 2024 20:49:33.907366037 CET	192.168.2.23	8.8.8.8	0xd60b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	333	false
Dec 8, 2024 20:49:36.050848007 CET	192.168.2.23	8.8.8.8	0xc175	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 8, 2024 20:49:36.173223019 CET	192.168.2.23	8.8.8.8	0xc175	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 8, 2024 20:49:36.296375990 CET	192.168.2.23	8.8.8.8	0xc175	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 8, 2024 20:49:36.418749094 CET	192.168.2.23	8.8.8.8	0xc175	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 8, 2024 20:49:36.541078091 CET	192.168.2.23	8.8.8.8	0xc175	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 8, 2024 20:49:38.694427013 CET	192.168.2.23	8.8.8.8	0x5aa4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	338	false
Dec 8, 2024 20:49:38.819091082 CET	192.168.2.23	8.8.8.8	0x5aa4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	338	false
Dec 8, 2024 20:49:38.941190958 CET	192.168.2.23	8.8.8.8	0x5aa4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	338	false
Dec 8, 2024 20:49:39.063307047 CET	192.168.2.23	8.8.8.8	0x5aa4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	339	false
Dec 8, 2024 20:49:39.185940027 CET	192.168.2.23	8.8.8.8	0x5aa4	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	339	false
Dec 8, 2024 20:49:41.329034090 CET	192.168.2.23	8.8.8.8	0x3e57	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	341	false
Dec 8, 2024 20:49:41.453984022 CET	192.168.2.23	8.8.8.8	0x3e57	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	341	false
Dec 8, 2024 20:49:41.578825951 CET	192.168.2.23	8.8.8.8	0x3e57	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	341	false
Dec 8, 2024 20:49:41.707803011 CET	192.168.2.23	8.8.8.8	0x3e57	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	341	false
Dec 8, 2024 20:49:41.836359024 CET	192.168.2.23	8.8.8.8	0x3e57	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	341	false
Dec 8, 2024 20:49:44.075865984 CET	192.168.2.23	8.8.8.8	0x984f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	344	false
Dec 8, 2024 20:49:44.198352098 CET	192.168.2.23	8.8.8.8	0x984f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	344	false
Dec 8, 2024 20:49:44.326883078 CET	192.168.2.23	8.8.8.8	0x984f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	344	false
Dec 8, 2024 20:49:44.456355095 CET	192.168.2.23	8.8.8.8	0x984f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	344	false
Dec 8, 2024 20:49:44.581743956 CET	192.168.2.23	8.8.8.8	0x984f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	344	false
Dec 8, 2024 20:49:46.712198019 CET	192.168.2.23	8.8.8.8	0x6fe6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	346	false
Dec 8, 2024 20:49:46.834384918 CET	192.168.2.23	8.8.8.8	0x6fe6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	346	false
Dec 8, 2024 20:49:46.956585884 CET	192.168.2.23	8.8.8.8	0x6fe6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	347	false
Dec 8, 2024 20:49:47.078756094 CET	192.168.2.23	8.8.8.8	0x6fe6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	347	false
Dec 8, 2024 20:49:47.201519012 CET	192.168.2.23	8.8.8.8	0x6fe6	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	347	false
Dec 8, 2024 20:49:49.378029108 CET	192.168.2.23	8.8.8.8	0x5dc7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	349	false
Dec 8, 2024 20:49:49.500118017 CET	192.168.2.23	8.8.8.8	0x5dc7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	349	false
Dec 8, 2024 20:49:49.622307062 CET	192.168.2.23	8.8.8.8	0x5dc7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	349	false
Dec 8, 2024 20:49:49.746387005 CET	192.168.2.23	8.8.8.8	0x5dc7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	349	false
Dec 8, 2024 20:49:49.871452093 CET	192.168.2.23	8.8.8.8	0x5dc7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	349	false
Dec 8, 2024 20:49:52.155289888 CET	192.168.2.23	8.8.8.8	0x35eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	352	false
Dec 8, 2024 20:49:52.277597904 CET	192.168.2.23	8.8.8.8	0x35eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	352	false
Dec 8, 2024 20:49:52.399761915 CET	192.168.2.23	8.8.8.8	0x35eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	352	false
Dec 8, 2024 20:49:52.525413990 CET	192.168.2.23	8.8.8.8	0x35eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	352	false
Dec 8, 2024 20:49:52.647666931 CET	192.168.2.23	8.8.8.8	0x35eb	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	352	false
Dec 8, 2024 20:49:54.792438984 CET	192.168.2.23	8.8.8.8	0xb369	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	354	false
Dec 8, 2024 20:49:54.916769981 CET	192.168.2.23	8.8.8.8	0xb369	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	354	false
Dec 8, 2024 20:49:55.185561895 CET	192.168.2.23	8.8.8.8	0xb369	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	355	false
Dec 8, 2024 20:49:55.307827950 CET	192.168.2.23	8.8.8.8	0xb369	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	355	false
Dec 8, 2024 20:49:55.431102991 CET	192.168.2.23	8.8.8.8	0xb369	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	355	false
Dec 8, 2024 20:49:57.586636066 CET	192.168.2.23	8.8.8.8	0xa052	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	357	false
Dec 8, 2024 20:49:57.709799051 CET	192.168.2.23	8.8.8.8	0xa052	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	357	false
Dec 8, 2024 20:49:57.832691908 CET	192.168.2.23	8.8.8.8	0xa052	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	357	false
Dec 8, 2024 20:49:57.954991102 CET	192.168.2.23	8.8.8.8	0xa052	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	358	false
Dec 8, 2024 20:49:58.279912949 CET	192.168.2.23	8.8.8.8	0xa052	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	358	false
Dec 8, 2024 20:50:00.792015076 CET	192.168.2.23	8.8.8.8	0xde3c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	360	false
Dec 8, 2024 20:50:00.920785904 CET	192.168.2.23	8.8.8.8	0xde3c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 8, 2024 20:50:01.045744896 CET	192.168.2.23	8.8.8.8	0xde3c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 8, 2024 20:50:01.169583082 CET	192.168.2.23	8.8.8.8	0xde3c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 8, 2024 20:50:01.291779041 CET	192.168.2.23	8.8.8.8	0xde3c	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 8, 2024 20:50:03.813509941 CET	192.168.2.23	8.8.8.8	0x8717	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	363	false
Dec 8, 2024 20:50:03.936340094 CET	192.168.2.23	8.8.8.8	0x8717	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 8, 2024 20:50:04.059180021 CET	192.168.2.23	8.8.8.8	0x8717	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 8, 2024 20:50:04.181556940 CET	192.168.2.23	8.8.8.8	0x8717	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 8, 2024 20:50:04.307362080 CET	192.168.2.23	8.8.8.8	0x8717	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 8, 2024 20:50:06.450750113 CET	192.168.2.23	8.8.8.8	0x776e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	366	false
Dec 8, 2024 20:50:06.576690912 CET	192.168.2.23	8.8.8.8	0x776e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	366	false
Dec 8, 2024 20:50:06.705971003 CET	192.168.2.23	8.8.8.8	0x776e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	366	false
Dec 8, 2024 20:50:06.833991051 CET	192.168.2.23	8.8.8.8	0x776e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	366	false
Dec 8, 2024 20:50:06.957992077 CET	192.168.2.23	8.8.8.8	0x776e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	367	false
Dec 8, 2024 20:50:09.175909042 CET	192.168.2.23	8.8.8.8	0x4fa8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 8, 2024 20:50:09.298465967 CET	192.168.2.23	8.8.8.8	0x4fa8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 8, 2024 20:50:09.423981905 CET	192.168.2.23	8.8.8.8	0x4fa8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 8, 2024 20:50:09.549874067 CET	192.168.2.23	8.8.8.8	0x4fa8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 8, 2024 20:50:09.672123909 CET	192.168.2.23	8.8.8.8	0x4fa8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 8, 2024 20:50:11.821213007 CET	192.168.2.23	8.8.8.8	0xb5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	371	false
Dec 8, 2024 20:50:11.943521976 CET	192.168.2.23	8.8.8.8	0xb5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	371	false
Dec 8, 2024 20:50:12.065648079 CET	192.168.2.23	8.8.8.8	0xb5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	372	false
Dec 8, 2024 20:50:12.190331936 CET	192.168.2.23	8.8.8.8	0xb5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	372	false
Dec 8, 2024 20:50:12.318023920 CET	192.168.2.23	8.8.8.8	0xb5e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	372	false
Dec 8, 2024 20:50:15.552220106 CET	192.168.2.23	1.1.1.1	0x54f2	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 8, 2024 20:50:15.552278042 CET	192.168.2.23	1.1.1.1	0xf51e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 8, 2024 20:47:48.338625908 CET	8.8.8.8	192.168.2.23	0x94d5	No error (0)	raw.cardiacpure.ru	178.215.238.4	A (IP address)	IN (0x0001)	false
Dec 8, 2024 20:48:37.660258055 CET	1.1.1.1	192.168.2.23	0x2ae0	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 8, 2024 20:48:37.660258055 CET	1.1.1.1	192.168.2.23	0x2ae0	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 8, 2024 20:50:15.791995049 CET	1.1.1.1	192.168.2.23	0x54f2	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 8, 2024 20:50:15.791995049 CET	1.1.1.1	192.168.2.23	0x54f2	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-08 19:48:41 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-08 19:48:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-08 19:48:42 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-08 19:48:44 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sun, 08 Dec 2024 19:48:44 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	19:47:46
Start date (UTC):	08/12/2024
Path:	/tmp/wnbw86.elf
Arguments:	/tmp/wnbw86.elf
File size:	116588 bytes
MD5 hash:	5f33f958945dce126f4f18ee23b09162

Start time (UTC):	19:47:48
Start date (UTC):	08/12/2024
Path:	/tmp/wnbw86.elf
Arguments:	-
File size:	116588 bytes
MD5 hash:	5f33f958945dce126f4f18ee23b09162

Start time (UTC):	19:49:15
Start date (UTC):	08/12/2024
Path:	/tmp/wnbw86.elf
Arguments:	-
File size:	116588 bytes
MD5 hash:	5f33f958945dce126f4f18ee23b09162

Start time (UTC):	19:47:47
Start date (UTC):	08/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	19:48:29
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:31
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:34
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:35
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:36
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:37
Start date (UTC):	08/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	19:48:38
Start date (UTC):	08/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wnbw86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6644/oom_score_adj

/proc/6950/oom_score_adj

/proc/7104/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:1076514nFn7qi

/run/systemd/journal/streams/.#9:1076523BYGHxi

/run/systemd/journal/streams/.#9:1076524tK4yCl

/run/systemd/journal/streams/.#9:1076525RwlACj

/run/systemd/journal/streams/.#9:1076526xxW0qh

/run/systemd/journal/streams/.#9:10765423vr4dl

/run/systemd/journal/streams/.#9:1076629c5vtWk

/run/systemd/journal/streams/.#9:1076630b3MRvk

/run/systemd/journal/streams/.#9:1076714OyopLh

/run/systemd/journal/streams/.#9:1076816OmGphh

/run/systemd/journal/streams/.#9:1076924ccMzHk

/run/systemd/journal/streams/.#9:1076972UuRPGi

/run/systemd/journal/streams/.#9:1076974KgxWPk

/run/systemd/journal/streams/.#9:1077112MD3tPj

/run/systemd/journal/streams/.#9:10771259c5Erk

/run/systemd/journal/streams/.#9:1077127uHYyBi

/run/systemd/journal/streams/.#9:4201535uETkuj

Linux Analysis Report
wnbw86.elf

Start time (UTC):	19:48:41
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:40
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:51
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:52
Start date (UTC):	08/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	19:48:53
Start date (UTC):	08/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	19:48:54
Start date (UTC):	08/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	-
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Start time (UTC):	19:48:58
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:48:59
Start date (UTC):	08/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	19:49:00
Start date (UTC):	08/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	19:49:01
Start date (UTC):	08/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761