Edit tour

Linux Analysis Report
wheiuwa4.elf

Overview

General Information

Sample name:	wheiuwa4.elf
Analysis ID:	1572939
MD5:	3d9f94b86edde676d3241c1707c965cb
SHA1:	b7121399cf77d48c48b2a256b8df1f3579603239
SHA256:	05ce105f8c50cc8ad232fb7e55d253713a438b08c38735bfea18f04fda288924
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1572939
Start date and time:	2024-12-11 09:57:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wheiuwa4.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/155@111/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: raw.cardiacpure.ru. [malformed]

Runtime Messages

Command:	/tmp/wheiuwa4.elf
PID:	6248
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6220, Parent: 4331)

rm (PID: 6220, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.OtbjvPRKwj /tmp/tmp.Cz2ynhvKDN /tmp/tmp.UXojMj6XMK

dash New Fork (PID: 6221, Parent: 4331)

rm (PID: 6221, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.OtbjvPRKwj /tmp/tmp.Cz2ynhvKDN /tmp/tmp.UXojMj6XMK

wheiuwa4.elf (PID: 6248, Parent: 6149, MD5: 5ebfcae4fe2471fcc5695c2394773ff1) Arguments: /tmp/wheiuwa4.elf

wheiuwa4.elf New Fork (PID: 6250, Parent: 6248)

wheiuwa4.elf New Fork (PID: 6252, Parent: 6250)

wheiuwa4.elf New Fork (PID: 6393, Parent: 6252)

sh (PID: 6393, Parent: 6252, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6399, Parent: 6393)

ps (PID: 6399, Parent: 6393, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

wheiuwa4.elf New Fork (PID: 6879, Parent: 6252)

sh (PID: 6879, Parent: 6252, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6881, Parent: 6879)

ps (PID: 6881, Parent: 6879, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6254, Parent: 1477)

sh (PID: 6254, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6254, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6259, Parent: 1)

systemd-hostnamed (PID: 6259, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6390, Parent: 1320)

Default (PID: 6390, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6392, Parent: 1320)

Default (PID: 6392, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6441, Parent: 1)

journalctl (PID: 6441, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6456, Parent: 1)

systemd-journald (PID: 6456, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6461, Parent: 1)

journalctl (PID: 6461, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6469, Parent: 1)

dbus-daemon (PID: 6469, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6480, Parent: 1320)

Default (PID: 6480, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6482, Parent: 1860)

pulseaudio (PID: 6482, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6484, Parent: 1)

rsyslogd (PID: 6484, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6486, Parent: 1)

rtkit-daemon (PID: 6486, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6489, Parent: 1)

systemd-logind (PID: 6489, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6554, Parent: 1)

polkitd (PID: 6554, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6559, Parent: 1)

gpu-manager (PID: 6559, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6561, Parent: 6559)

sh (PID: 6561, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6563, Parent: 6561)

grep (PID: 6563, Parent: 6561, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6564, Parent: 6559)

sh (PID: 6564, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6565, Parent: 6564)

grep (PID: 6565, Parent: 6564, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6566, Parent: 6559)

sh (PID: 6566, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6567, Parent: 6566)

grep (PID: 6567, Parent: 6566, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6568, Parent: 6559)

sh (PID: 6568, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6571, Parent: 6568)

grep (PID: 6571, Parent: 6568, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6572, Parent: 6559)

sh (PID: 6572, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6573, Parent: 6572)

grep (PID: 6573, Parent: 6572, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6574, Parent: 6559)

sh (PID: 6574, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6575, Parent: 6574)

grep (PID: 6575, Parent: 6574, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6576, Parent: 6559)

sh (PID: 6576, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6577, Parent: 6576)

grep (PID: 6577, Parent: 6576, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6578, Parent: 6559)

sh (PID: 6578, Parent: 6559, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6580, Parent: 6578)

grep (PID: 6580, Parent: 6578, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6560, Parent: 1)

agetty (PID: 6560, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gvfsd-fuse New Fork (PID: 6582, Parent: 2038)

fusermount (PID: 6582, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6583, Parent: 1)

generate-config (PID: 6583, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6587, Parent: 6583)

pkill (PID: 6587, Parent: 6583, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6588, Parent: 1)

gdm-wait-for-drm (PID: 6588, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6594, Parent: 1)

gdm3 (PID: 6594, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6597, Parent: 6594)

plymouth (PID: 6597, Parent: 6594, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6609, Parent: 6594)

gdm-session-worker (PID: 6609, Parent: 6594, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6613, Parent: 6609)

gdm-wayland-session (PID: 6613, Parent: 6609, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6615, Parent: 6613)

dbus-daemon (PID: 6615, Parent: 6613, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6617, Parent: 6615)

dbus-daemon New Fork (PID: 6618, Parent: 6617)

false (PID: 6618, Parent: 6617, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6619, Parent: 6613)

dbus-run-session (PID: 6619, Parent: 6613, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6620, Parent: 6619)

dbus-daemon (PID: 6620, Parent: 6619, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6621, Parent: 6594)

Default (PID: 6621, Parent: 6594, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6622, Parent: 6594)

Default (PID: 6622, Parent: 6594, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6598, Parent: 1)

accounts-daemon (PID: 6598, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6604, Parent: 6598)

language-validate (PID: 6604, Parent: 6598, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6605, Parent: 6604)

language-options (PID: 6605, Parent: 6604, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6606, Parent: 6605)

sh (PID: 6606, Parent: 6605, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6607, Parent: 6606)

locale (PID: 6607, Parent: 6606, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6608, Parent: 6606)

grep (PID: 6608, Parent: 6606, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6624, Parent: 1)

rsyslogd (PID: 6624, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6625, Parent: 1)

agetty (PID: 6625, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6627, Parent: 1)

dbus-daemon (PID: 6627, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6633, Parent: 1)

gpu-manager (PID: 6633, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6634, Parent: 6633)

sh (PID: 6634, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6636, Parent: 6634)

grep (PID: 6636, Parent: 6634, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6697, Parent: 6633)

sh (PID: 6697, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6698, Parent: 6697)

grep (PID: 6698, Parent: 6697, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6700, Parent: 6633)

sh (PID: 6700, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6701, Parent: 6700)

grep (PID: 6701, Parent: 6700, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6702, Parent: 6633)

sh (PID: 6702, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6703, Parent: 6702)

grep (PID: 6703, Parent: 6702, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6704, Parent: 6633)

sh (PID: 6704, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6705, Parent: 6704)

grep (PID: 6705, Parent: 6704, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6706, Parent: 6633)

sh (PID: 6706, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6707, Parent: 6706)

grep (PID: 6707, Parent: 6706, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6708, Parent: 6633)

sh (PID: 6708, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6709, Parent: 6708)

grep (PID: 6709, Parent: 6708, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6710, Parent: 6633)

sh (PID: 6710, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6711, Parent: 6710)

grep (PID: 6711, Parent: 6710, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6639, Parent: 1)

systemd-logind (PID: 6639, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6712, Parent: 1)

generate-config (PID: 6712, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6713, Parent: 6712)

pkill (PID: 6713, Parent: 6712, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6714, Parent: 1)

gdm-wait-for-drm (PID: 6714, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6719, Parent: 1)

rsyslogd (PID: 6719, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6730, Parent: 1)

dbus-daemon (PID: 6730, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6731, Parent: 1)

journalctl (PID: 6731, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6732, Parent: 1)

systemd-journald (PID: 6732, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6735, Parent: 1)

systemd-logind (PID: 6735, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6792, Parent: 1)

agetty (PID: 6792, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6793, Parent: 1)

rsyslogd (PID: 6793, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6795, Parent: 1)

dbus-daemon (PID: 6795, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6796, Parent: 1)

systemd-journald (PID: 6796, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6802, Parent: 1)

systemd-logind (PID: 6802, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6859, Parent: 1)

gpu-manager (PID: 6859, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6860, Parent: 6859)

sh (PID: 6860, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6861, Parent: 6860)

grep (PID: 6861, Parent: 6860, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6863, Parent: 6859)

sh (PID: 6863, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6864, Parent: 6863)

grep (PID: 6864, Parent: 6863, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6865, Parent: 6859)

sh (PID: 6865, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6866, Parent: 6865)

grep (PID: 6866, Parent: 6865, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6867, Parent: 6859)

sh (PID: 6867, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6868, Parent: 6867)

grep (PID: 6868, Parent: 6867, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6871, Parent: 6859)

sh (PID: 6871, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6872, Parent: 6871)

grep (PID: 6872, Parent: 6871, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6874, Parent: 6859)

sh (PID: 6874, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6875, Parent: 6874)

grep (PID: 6875, Parent: 6874, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6877, Parent: 6859)

sh (PID: 6877, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6878, Parent: 6877)

grep (PID: 6878, Parent: 6877, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6883, Parent: 6859)

sh (PID: 6883, Parent: 6859, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6884, Parent: 6883)

grep (PID: 6884, Parent: 6883, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6885, Parent: 1)

generate-config (PID: 6885, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6886, Parent: 6885)

pkill (PID: 6886, Parent: 6885, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6889, Parent: 1)

gdm-wait-for-drm (PID: 6889, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6894, Parent: 1)

gdm3 (PID: 6894, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6897, Parent: 6894)

plymouth (PID: 6897, Parent: 6894, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6911, Parent: 6894)

gdm-session-worker (PID: 6911, Parent: 6894, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6915, Parent: 6911)

gdm-wayland-session (PID: 6915, Parent: 6911, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6917, Parent: 6915)

dbus-daemon (PID: 6917, Parent: 6915, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6919, Parent: 6917)

dbus-daemon New Fork (PID: 6920, Parent: 6919)

false (PID: 6920, Parent: 6919, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6921, Parent: 6915)

dbus-run-session (PID: 6921, Parent: 6915, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6922, Parent: 6921)

dbus-daemon (PID: 6922, Parent: 6921, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6923, Parent: 6894)

Default (PID: 6923, Parent: 6894, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6924, Parent: 6894)

Default (PID: 6924, Parent: 6894, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6898, Parent: 1)

accounts-daemon (PID: 6898, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6902, Parent: 6898)

language-validate (PID: 6902, Parent: 6898, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6903, Parent: 6902)

language-options (PID: 6903, Parent: 6902, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6904, Parent: 6903)

sh (PID: 6904, Parent: 6903, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6905, Parent: 6904)

locale (PID: 6905, Parent: 6904, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6906, Parent: 6904)

grep (PID: 6906, Parent: 6904, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6907, Parent: 1)

polkitd (PID: 6907, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6939, Parent: 1)

systemd-journald (PID: 6939, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6940, Parent: 1)

dbus-daemon (PID: 6940, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6941, Parent: 1)

agetty (PID: 6941, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6944, Parent: 1)

systemd-logind (PID: 6944, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6961, Parent: 1)

dbus-daemon (PID: 6961, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6962, Parent: 1)

rsyslogd (PID: 6962, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7008, Parent: 1)

gpu-manager (PID: 7008, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7011, Parent: 7008)

sh (PID: 7011, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7012, Parent: 7011)

grep (PID: 7012, Parent: 7011, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7013, Parent: 7008)

sh (PID: 7013, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7014, Parent: 7013)

grep (PID: 7014, Parent: 7013, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7015, Parent: 7008)

sh (PID: 7015, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7017, Parent: 7015)

grep (PID: 7017, Parent: 7015, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7019, Parent: 7008)

sh (PID: 7019, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7020, Parent: 7019)

grep (PID: 7020, Parent: 7019, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7022, Parent: 7008)

sh (PID: 7022, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7023, Parent: 7022)

grep (PID: 7023, Parent: 7022, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7024, Parent: 7008)

sh (PID: 7024, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7025, Parent: 7024)

grep (PID: 7025, Parent: 7024, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7026, Parent: 7008)

sh (PID: 7026, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7027, Parent: 7026)

grep (PID: 7027, Parent: 7026, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7030, Parent: 7008)

sh (PID: 7030, Parent: 7008, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7031, Parent: 7030)

grep (PID: 7031, Parent: 7030, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7029, Parent: 1860)

dbus-daemon (PID: 7029, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7032, Parent: 1860)

pulseaudio (PID: 7032, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7033, Parent: 1)

rtkit-daemon (PID: 7033, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7036, Parent: 1)

polkitd (PID: 7036, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7037, Parent: 1)

generate-config (PID: 7037, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7042, Parent: 7037)

pkill (PID: 7042, Parent: 7037, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7044, Parent: 1)

gdm-wait-for-drm (PID: 7044, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7051, Parent: 1)

gdm3 (PID: 7051, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7054, Parent: 7051)

plymouth (PID: 7054, Parent: 7051, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7066, Parent: 7051)

gdm-session-worker (PID: 7066, Parent: 7051, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7072, Parent: 7066)

gdm-wayland-session (PID: 7072, Parent: 7066, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7074, Parent: 7072)

dbus-daemon (PID: 7074, Parent: 7072, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7078, Parent: 7074)

dbus-daemon New Fork (PID: 7079, Parent: 7078)

false (PID: 7079, Parent: 7078, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7080, Parent: 7072)

dbus-run-session (PID: 7080, Parent: 7072, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7081, Parent: 7080)

dbus-daemon (PID: 7081, Parent: 7080, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7083, Parent: 7051)

Default (PID: 7083, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7084, Parent: 7051)

Default (PID: 7084, Parent: 7051, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7055, Parent: 1)

accounts-daemon (PID: 7055, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7059, Parent: 7055)

language-validate (PID: 7059, Parent: 7055, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7060, Parent: 7059)

language-options (PID: 7060, Parent: 7059, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7061, Parent: 7060)

sh (PID: 7061, Parent: 7060, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7062, Parent: 7061)

locale (PID: 7062, Parent: 7061, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7063, Parent: 7061)

grep (PID: 7063, Parent: 7061, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7070, Parent: 1)

systemd (PID: 7070, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7075, Parent: 7070)

systemd New Fork (PID: 7076, Parent: 7075)

30-systemd-environment-d-generator (PID: 7076, Parent: 7075, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7087, Parent: 7070)

systemctl (PID: 7087, Parent: 7070, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7088, Parent: 7070)

pulseaudio (PID: 7088, Parent: 7070, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7093, Parent: 7070)

dbus-daemon (PID: 7093, Parent: 7070, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wheiuwa4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wheiuwa4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f6a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f75c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6248.1.00007f2c18017000.00007f2c1803a000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6248.1.00007f2c18017000.00007f2c1803a000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f6a8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6bc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6d0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6e4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f6f8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f70c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f720:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f734:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f748:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f75c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f770:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f784:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f798:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f810:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f824:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f838:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wheiuwa4.elf PID: 6248	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wheiuwa4.elf PID: 6248	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xf76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xf9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xfee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1002:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1016:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1052:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1066:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x107a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x108e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10a2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10b6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10ca:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10de:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10f2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1106:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6484)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6624)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6719)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6793)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6962)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6456)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6594)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6615)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6732)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6796)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6894)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6917)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6939)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7051)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7074)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7081)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7070)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.136.dr, syslog.47.dr, syslog.186.dr, syslog.198.dr, syslog.294.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 38376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38376
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wheiuwa4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6248.1.00007f2c18017000.00007f2c1803a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wheiuwa4.elf PID: 6248, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4493, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4504, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4524, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6174, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6210, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6391, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6393, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6469, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6484, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6560, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6594, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6623, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6625, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6627, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6717, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6714, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6718, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6719, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6732, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6793, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6794, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6795, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6796, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6879, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6881, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6894, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6940, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6254, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2018, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4493, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4504, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 4524, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6061, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6062, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6174, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6184, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6210, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6391, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6393, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6469, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6484, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6560, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6594, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6623, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6625, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6627, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6717, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6714, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6718, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6719, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6730, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6732, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6793, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6794, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6795, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6796, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6879, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6881, result: no such process	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6894, result: successful	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	SIGKILL sent: pid: 6940, result: successful	Jump to behavior

Source: wheiuwa4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6248.1.00007f2c18017000.00007f2c1803a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wheiuwa4.elf PID: 6248, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/155@111/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6469)	File: /proc/6469/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6582)	File: /proc/6582/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6615)	File: /proc/6615/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6620)	File: /proc/6620/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6627)	File: /proc/6627/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6730)	File: /proc/6730/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6795)	File: /proc/6795/mounts
Source: /usr/bin/dbus-daemon (PID: 6917)	File: /proc/6917/mounts
Source: /usr/bin/dbus-daemon (PID: 6922)	File: /proc/6922/mounts
Source: /usr/bin/dbus-daemon (PID: 6961)	File: /proc/6961/mounts
Source: /usr/bin/dbus-daemon (PID: 7029)	File: /proc/7029/mounts
Source: /usr/bin/dbus-daemon (PID: 7074)	File: /proc/7074/mounts
Source: /usr/bin/dbus-daemon (PID: 7081)	File: /proc/7081/mounts
Source: /usr/bin/dbus-daemon (PID: 7093)	File: /proc/7093/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6254)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6254)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6259)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:74547kMOheo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:74548CTKo0n	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:74590EYgo3o	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:75850yyMS6o	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:74687ge52lm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:77103jKLpGo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:771049vmEGn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:77128sPvrqp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:77290BlblFl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:77417SXb4lm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:77510s1Mwfl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:775154YIZRo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:764388zYy4o	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:76460SYWBQo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:76484o0kOVl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:764856sgJVk	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:76514PTCk0n	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:765158ByBdp	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:76595Wcc43l	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:76694p2gbrm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:76767XZp2Tn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:78902kgspAl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:78929jFmPTl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:78316mgh9Yl	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:78392do8Kfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:78500osthCo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	File: /run/systemd/journal/streams/.#9:78510oEaECl	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	File: /run/systemd/seats/.#seat0XyBEbT	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	File: /run/systemd/users/.#127oOgVER	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	File: /run/systemd/users/.#127whCabS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	File: /run/systemd/seats/.#seat02qU6aS	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	File: /run/systemd/users/.#127smAJzR	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6489)	File: /run/systemd/users/.#127JZUL9R	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6554)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6613)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6598)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6598)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6639)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6639)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6639)	File: /run/systemd/seats/.#seat0Gv4d5a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6735)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6735)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6735)	File: /run/systemd/seats/.#seat0QLb53t
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80115W7mEW5
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80116xeOKd6
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80117su4y92
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:801183FlSP3
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80131J5FPO4
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80132BlLh62
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:801333KrIj6
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80134h2LV06
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80141GMMES3
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:80999dVl2z5
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:81026YLcj66
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:81056JMNlo7
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:81057O1JTf5
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:81089H8qEp5
Source: /lib/systemd/systemd-journald (PID: 6796)	File: /run/systemd/journal/streams/.#9:81090AhjoP4
Source: /lib/systemd/systemd-logind (PID: 6802)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6802)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6802)	File: /run/systemd/seats/.#seat0o1Y00u
Source: /lib/systemd/systemd-logind (PID: 6802)	File: /run/systemd/users/.#127vD5dFw
Source: /lib/systemd/systemd-logind (PID: 6802)	File: /run/systemd/users/.#127nx7EZv
Source: /lib/systemd/systemd-logind (PID: 6802)	File: /run/systemd/seats/.#seat0m3Qo6x
Source: /lib/systemd/systemd-logind (PID: 6802)	File: /run/systemd/users/.#127QYHcey
Source: /lib/systemd/systemd-logind (PID: 6802)	File: /run/systemd/users/.#127wFgSBw
Source: /lib/systemd/systemd-logind (PID: 6802)	File: /run/systemd/users/.#127d9f7Jw
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6915)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6898)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6898)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6907)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643840WOa02U
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643841Sle0YS
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643842I9XHSV
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643856Qqn51T
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643859qGrggV
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643868gIDuAS
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643875R7VbsT
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643878hXqHCU
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643879Q2dPeS
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:6439730XRl7S
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:643974j2OoCS
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:10495732vssuT
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2185296pKRjDS
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2381955B1NEqU
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2382597ks1sgT
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2378297vSLqDS
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2378303OaSPJR
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2378305ReUh6U
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2378481QrKcFU
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2378528LwOqET
Source: /lib/systemd/systemd-journald (PID: 6939)	File: /run/systemd/journal/streams/.#9:2378654oXRqjV
Source: /lib/systemd/systemd-logind (PID: 6944)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6944)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/seats/.#seat0eaatei
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/users/.#127nmJ7Qh
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/users/.#127mqinSg
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/seats/.#seat0aWW2ng
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/users/.#127Ololxg
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/users/.#127xHzP7f
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/users/.#127uWWpvh
Source: /lib/systemd/systemd-logind (PID: 6944)	File: /run/systemd/users/.#127YTaTxi
Source: /usr/lib/policykit-1/polkitd (PID: 7036)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7072)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7055)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7055)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7070)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7076)	Directory: <invalid fd (4)>/.config

Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6252)	File opened: /proc/237/cmdline	Jump to behavior

Source: /tmp/wheiuwa4.elf (PID: 6393)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/wheiuwa4.elf (PID: 6879)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6561)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6564)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6566)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6568)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6572)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6574)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6576)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6578)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6606)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6634)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6697)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6700)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6702)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6704)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6706)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6708)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6710)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6860)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6863)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6865)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6867)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6871)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6874)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6877)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6883)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6904)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7011)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7013)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7015)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7019)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7022)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7024)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7026)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7030)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7061)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6563)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6565)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6567)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6571)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6573)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6575)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6577)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6580)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6608)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6636)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6698)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6701)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6703)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6705)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6707)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6709)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6711)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6861)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6864)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6866)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6868)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6872)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6875)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6878)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6884)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6906)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7012)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7014)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7017)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7020)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7023)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7025)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7027)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7031)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7063)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6587)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6713)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6886)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7042)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6399)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6881)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /usr/bin/dash (PID: 6220)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.OtbjvPRKwj /tmp/tmp.Cz2ynhvKDN /tmp/tmp.UXojMj6XMK			Jump to behavior
Source: /usr/bin/dash (PID: 6221)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.OtbjvPRKwj /tmp/tmp.Cz2ynhvKDN /tmp/tmp.UXojMj6XMK			Jump to behavior

Source: /lib/systemd/systemd (PID: 7087)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6399)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6881)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6732)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6796)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6939)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6560)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6625)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6792)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6941)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6594)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6594)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6598)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6598)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6894)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6894)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6898)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6898)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7051)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7051)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7055)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7055)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6484)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6484)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6559)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6624)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6624)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6633)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6719)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6793)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6793)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6859)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6962)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6962)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7008)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wheiuwa4.elf (PID: 6250)

File: /tmp/wheiuwa4.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6559)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6633)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6859)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7008)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6399)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6881)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6482)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6587)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6713)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6886)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7032)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7042)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7088)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/wheiuwa4.elf (PID: 6248)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6259)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6456)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6482)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6484)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6559)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6560)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6609)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6624)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6625)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6633)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6719)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6732)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6792)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6793)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6796)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6859)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6911)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6939)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6941)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6962)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7008)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7032)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7066)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7088)	Queries kernel information via 'uname':

Source: wheiuwa4.elf, 6248.1.00007ffd60943000.00007ffd60964000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.jUHFvF
Source: wheiuwa4.elf, 6248.1.00007ffd60943000.00007ffd60964000.rw-.sdmp	Binary or memory string: V/tmp/qemu-open.jUHFvF:
Source: syslog.294.dr	Binary or memory string: Dec 11 03:00:35 galassia kernel: [ 580.856526] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.294.dr	Binary or memory string: Dec 11 03:00:35 galassia kernel: [ 580.856552] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: wheiuwa4.elf, 6248.1.0000561f84fbe000.0000561f850ec000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: wheiuwa4.elf, 6248.1.00007ffd60943000.00007ffd60964000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: wheiuwa4.elf, 6248.1.0000561f84fbe000.0000561f850ec000.rw-.sdmp	Binary or memory string: V!/etc/qemu-binfmt/arm
Source: wheiuwa4.elf, 6248.1.00007ffd60943000.00007ffd60964000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/wheiuwa4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wheiuwa4.elf

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6598)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6898)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7055)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wheiuwa4.elf, type: SAMPLE
Source: Yara match	File source: 6248.1.00007f2c18017000.00007f2c1803a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wheiuwa4.elf PID: 6248, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wheiuwa4.elf, type: SAMPLE
Source: Yara match	File source: 6248.1.00007f2c18017000.00007f2c1803a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wheiuwa4.elf PID: 6248, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wheiuwa4.elf	66%	ReversingLabs	Linux.Trojan.Mirai
wheiuwa4.elf	41%	Virustotal		Browse
wheiuwa4.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.25	true	false	high
raw.cardiacpure.ru	178.215.238.4	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	true	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.136.dr, syslog.47.dr, syslog.186.dr, syslog.198.dr, syslog.294.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	sh4.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse
	tarm6.elf	Get hash	malicious	Unknown	Browse
	bot.mpsl.elf	Get hash	malicious	Mirai, Gafgyt, Okiru	Browse
	.5r3fqt67ew531has4231.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse
	bin.sh.elf	Get hash	malicious	Unknown	Browse
	m.-..-6-.-8k.elf	Get hash	malicious	Gafgyt	Browse
162.213.35.24	iwir64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	wnbw86.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse
	tgCdafZIfZ.elf	Get hash	malicious	Mirai	Browse
	LiUgL2AoGI.elf	Get hash	malicious	Mirai	Browse
	16RIueF7yh.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	tftp.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	main_arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	tgCdafZIfZ.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	sshd.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	Josho.arm7.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	Josho.x86.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	Josho.sh4.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
raw.cardiacpure.ru	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	tgCdafZIfZ.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	LiUgL2AoGI.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	16RIueF7yh.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	rebirth.arm.elf	Get hash	malicious	Mirai, Okiru	Browse	185.122.56.64
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wnbw86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	iwir64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.sh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	Josho.m68k.elf	Get hash	malicious	Unknown	Browse	200.1.79.131
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	94.154.172.218
	wnbw86.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	home.arm.elf	Get hash	malicious	Mirai, Gafgyt	Browse	200.1.79.189
	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	17334905466c073176eadfc4a4d1af620c5aa97d12d1156570ede93d276f9fa6d51fffb6c5778.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	45.88.88.7
	1733479268d0423578683b481c87d2b90a74213612e8837faf7f066c8e81ec92f9b2658c65965.dat-decoded.exe	Get hash	malicious	AsyncRAT, VenomRAT	Browse	45.88.88.7
	17334178295ea73ab6cd4726fd542025ef7b7421cc440e3878f9b14a611f40e1dc873ff7cc498.dat-decoded.exe	Get hash	malicious	Njrat	Browse	45.88.88.7
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
AMAZON-02US	HSBC Payment Notification Scan Copy Ref 62587299-24_PDF.exe	Get hash	malicious	MassLogger RAT	Browse	18.141.10.107
	https://advertising-case-id419348.d1yaxxd8bf42y5.amplifyapp.com/	Get hash	malicious	Unknown	Browse	108.158.75.45
	arm7.elf	Get hash	malicious	Unknown	Browse	34.249.145.219
	sh4.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	x86.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	6dKYHqbvOm.exe	Get hash	malicious	Njrat	Browse	35.158.159.254
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	CJE003889.exe	Get hash	malicious	FormBook	Browse	13.228.81.39
CANONICAL-ASGB	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sh4.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.sparc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.mipsel.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6618/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6920/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7079/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mQUv:mQUv
MD5:	90E21C35A28EE4CBBCFF16FEB8055422
SHA1:	1621EE323FCD21973BA0B8B99A3C8EA0C24536E7
SHA-256:	5F6136FC6336812943673A6EFC3A4ECC6523C05C8555EA40935238B570BA96D9
SHA-512:	365D120B225F1300942C0F4F1DCFB4A2792860A1C7810C290A747569AAEC72F990B2E207687B1E27175AE8FDD7E965F950D6D3B021194CB328D720651C7063E8
Malicious:	false
Preview:	7051.

/run/systemd/journal/streams/.#9:10495732vssuT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.421829424315227
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9YdEJBN0js2BZZGu:SbFuFyLVIg1BAf+MSdjNTZD
MD5:	55A82539BD3C45DE7BF61C04EC7CFEC0
SHA1:	31D4C1665CE1A65AC3FE18B6B26E121E3BE38243
SHA-256:	703175816A8838059F05665CEF6A1F0E9C160E0B5C87B7D62FBE5FAE0778B193
SHA-512:	E317526AC42381DFA5108FB5B8EF56E3D4E5BB41B910C037F74F6C250C9677FFE0DAD56A3ADFBB0ABE8B60BC462177F75FBD3424B70057A5FCFEE91D3B1E35F5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7fa30798bda04e15b249d6987652a9e7.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:2185296pKRjDS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.452061699613001
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+ucwFk2jLTTIWTIL:qgFq6g10+f+MlFk6EWEL
MD5:	7C9FF8C9E2B664147B97B302F069EEA2
SHA1:	D49E0EDACE9FBC42E612B3262629740B86A5B844
SHA-256:	EA3CB276D83501362B859E025BBF31CE4525FAAF74BDF34907C77B7E3C6277D1
SHA-512:	EA633D16E8E76123EED6175E9F552E796640D1AB8329F21B4062A75B16CDED3E29EE37B68F0C6605771018F0BBCEB2F90D4C8547DCC4D5AB30B67ADEF9B42B08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=478f543e54dd4119acab97f6b2e2ced6.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:2378297vSLqDS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.41010342604836
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4B3aZjurqjZcHBrt:qgFq6g10+f+M4BKSkmBB
MD5:	96355AD5E0E92350C0DF4E8BBAC30A41
SHA1:	8CB5EDCA1EC5F0214E7059B782744F8E468163CA
SHA-256:	0A22BF66EFCCF7E6CA8C78D88D502305CD627763505549372DE172253D9366B0
SHA-512:	3D6A74170AD40C3AD2C9353FC4F118BF30527A99CB9E3ED02F65EED8E849AE70EB9FAE1E9D5CCF19BD209A1170D3CE92A48E38E5F122CF40B66B069A23969A24
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2d11d267e2514cada8352542747c7f91.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:2378303OaSPJR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.471579696992284
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mw9Bu5qjFQMzKaBu:qgFqo6g7/+0+f+MSw+Tmh
MD5:	914C215008EDC5EAA5F79D51327272A2
SHA1:	57E041C1B43237D3FB8D40C0BF59E0E6DE166012
SHA-256:	4A6652AA52EDF4A6E4DF1EEACCCC58133A8109771211134D821526FEB047EBED
SHA-512:	1B64D91005E08F6875CD47801384301765E911FE7A6C7DF9EBA19A7D3A9905B5A8C7AA671EAACC15A51E99B0A378A3A6FCBAB545CD42009C4F81A2A84324C29B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a029631e323e4eeda78b1e46dc3acd41.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:2378305ReUh6U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.468261287411236
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M84WE3qYjFQMzKaBu:qgFqdg7/+0+f+M84WXSTmh
MD5:	34E55A12900BC665F7E39ABC760DEE1B
SHA1:	33CA45A73B83FAFF966A19B91D8313559158A610
SHA-256:	1BF20F9435417376FAFBB0D596DC50B03E2B2A1F1F91B83D809CE01E262DF0F7
SHA-512:	58D4C4D9BA9906658CAF80AA8BDCA66E598A6781844021D9149CCADD3A3CCA7CEFC50B8A18F712E6377B887915E7336695E8284C520E4CB4CDEB4CCB5DB9D8B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=609ccf22930b48cdacc4affccdf2da96.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:2378481QrKcFU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.351854318777128
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoEW1wvF+5rqjsicWI:SbFuFyLVIg1BG+f+MoZyvFKqjZcHjv
MD5:	39431FA61C0F0C910186E05C49CDA8BE
SHA1:	DF155E536DA1A796560AD07CB806F5160E3E9D68
SHA-256:	0536B8DEB940BA44FAFAA407F1744F60991D23A997891E7873F93B092DE60F97
SHA-512:	1EB4F727D51FD89DE5986F6E383BE075AC20C3B0E44310F7EDED11CB172B6BC1FE812F0CB966816CB0EF30E1A2398F3769CDAE79EE1523AA6D643726AAD7E53F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ba348d6d0b664dc49a5daba962b59c97.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:2378528LwOqET

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.389016891998282
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzgVdDUOl9glsjshQJ:SbFuFyLVIg1BG+f+MCdIOlNjtWL0
MD5:	F5D765AD0C06264725601DD699985DF5
SHA1:	3B581C0C8771512B7928E11EAFE693F576CBE343
SHA-256:	12246672618CE8EF376AB227018200130BF9FF0DA633FA96A4791DDD9541636A
SHA-512:	3B5A3D7ABC50872ECC8520A9643D59FCA9EBC140CDBD9541BA04572DB64DA2D2BE34463F8EC623C22D0C79D5DB1DA9E328AE60C563017D1844FBE8767775ED4D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9b2537b05378435d915fdca484fe6be3.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:2378654oXRqjV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.405841726203885
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuPUcA8pWApXAW/A+Q:SbFuFyLVIg1BG+f+Mu9/pW0QWkjoa
MD5:	DCEF399D57B3D42D051EABB83B9309B5
SHA1:	52FAFC4BF17F636E28748BAA06BCCD408F88DF46
SHA-256:	3A9426C9AC4B1372FD06C55FA37B273C0868E2A68275FF3E97F5B150F92C6382
SHA-512:	82D3A30E2E62E490C3DD39D58DEB6ABA2BE070BA7507EC3CD9DFDD11B0BF210BA0B3C7429C465246CA1D84AE16A32DFBC94705467E0DB1DE872FE84AA5BA0642
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de5a8919eb9c4c738634a469fdb52e32.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:2381955B1NEqU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4258318987434135
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrZlUGf0+qjs2BD0:SbFuFyLVK6g7/+BG+f+MVpf0+qjNq
MD5:	6D43943D3BFDADFD7730BDF0678901B8
SHA1:	338AABE5D816A44D874E6B77C2463816D609D74B
SHA-256:	132476E488FEE8B568DEF01D6841D88B9366F2BB6E5C10A9D1FDFE0840C65AA9
SHA-512:	D02F393A8BA903B66AB38B131BC5F0CFC9527952CF86284C11530E295649BB202DA524DFD6B7A5DA4BCA1ACBB1359055311AD78D51BA485188B43D3E6BCE3566
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=afc7996bf1c64763a34e07671e4523d7.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:2382597ks1sgT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.404674478132783
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+My8BFaqTAuqjNq:qgFqdg7/+0+f+MtfTAFq
MD5:	B8FF2F176181DEC25A8729C4501C2DE1
SHA1:	5AFB32D7B138FE0F97DBC2DC4B2A0B45BF81DA36
SHA-256:	FBD24AD61E882989E4EAF12226A7954BDB75747ACBF11C2DA3B3B1AAA13F7EDD
SHA-512:	D05B351E926AD5201187A63FCF53134F4C4AF45940305DC261B115851782FF6148A336FC4A135E76BAA5FACDE7AEF038BD79C1DCD45E479F75605DF078DA3D70
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=333cd59b9e5240d49bb7e91c11214cac.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:643840WOa02U

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4016086188995
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoGj2ToB/cv8josQu:qgFq6g10+f+MoGjqwciQu
MD5:	67EA63CF6FE924494F26EE1AC63EB030
SHA1:	3D766FC0DB00E2BD81B50713206420C1391BAB35
SHA-256:	4CF2514AD2F7847BE103265401D4E4BEB8674D26E698D7EE0636C52E16A63C15
SHA-512:	8559B53A71BC72B1949875F5E90EC3ADA73E605E84C3FFF7428A038F3706BA2869837A040B11DCD496E3772BC32A3930E7C1978312B35401EE93009DB0E96B58
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b3d851ec095c4e97af3b834b7ddd7b59.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:643841Sle0YS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.452405636456947
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpgqkIhT0jsicWmI2d:SbFuFyLVIg1BG+f+MHkIhT0jZcHcljX+
MD5:	D939AA6ABDEF83BFEC8851D6F82C07B6
SHA1:	839057A3295634725C2CD1E3EC910DB77944A625
SHA-256:	B8EACD996B43CDC32FAAA2B183327046C257EDDD0850643A2822D35DF301ACBE
SHA-512:	AFFE0FE549D28498B339F66F627D6743F5AFF9FA3DDB69D0982B09912B675278774B3F76FD91453E23F084BFDA14568D7E68405DC35B7674825804050BAD9C28
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c6540e31ede74449b10e7f463df0ccb6.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:643842I9XHSV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4289104761671485
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+7KRUBQScZk2rxsjx:SbFuFyLVIg1BG+f+M+eRGcaZjosQu
MD5:	C2CBA61B594EA84E8A7CC13EB48E821A
SHA1:	FBF540480D96594D30931FACC74466160ADF20BE
SHA-256:	63BC7AC5283DB2392C71A7242809E1F146B031F846A5F09DE252F42516610455
SHA-512:	4F8B4BE3A40A29CAC3DCDA6B147436708BC749E6D3C20BC3BEF946B21FB9C743E01AE9AF024622DAF9AF13C71AF6842B20F7A49FC28C8BE16BCCA7EB4AE40BED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4dcf912ecf0f47288f5e2fd06a89c1e2.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:643856Qqn51T

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4082121024354946
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoC1ddaRJqjdCLKzK:qgFq6g10+f+MoC1ddaR2CLAK
MD5:	3BBB276CA7FF3772F9CD999EEB0B7048
SHA1:	7D6632B79FDB183717BDAF6C894D87D289035FED
SHA-256:	E3E1D996F8940CA868FEB892837B1F6CB800D54F46A17118C0B5F14C080A2677
SHA-512:	0FE73BEAFD37E05EFAD0B5BD0D01844E64CFA4802CE71212FFC070A96A3D994A7D8682F55E2807AE52E877E087E1FEC6C8FA6ABD47BCC148FA62CB877CAFB27D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b8edf864199d4395a95a1369c2417661.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:643859qGrggV

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.379184020371524
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4AdpgUUbGXTWX2AAv:SbFuFyLVIg1BG+f+M4jbGXTWojoa
MD5:	19AFECF60F5EE1BED048217543389B6E
SHA1:	126154514E540566273D14F127843E2516A405CC
SHA-256:	5C32FA2D731A554D3DD959437332216AFE0042735FDE4A5AB8EB3EA2549B82F3
SHA-512:	DCC72BF101E30BFED47B2DB925056C2F10C38898E8A264F907D678B5AA81873B6A825E6A7376F9852983FA68705593548F4C55BAEE0BF6393CABFB461F51A6BB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2e0750f7ae014d139c8349ac8632deef.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:643868gIDuAS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3847789585826975
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp0Ufn45uQhcQ4uqjt:SbFuFyLVIg1BG+f+M6Uf4wQhhZqjtWL0
MD5:	B82677635CA8B592558D8B9B74125252
SHA1:	FDAE62B2ADEC9A060502057213A2C0AA4AF935EF
SHA-256:	374250A36BCF07FD4DA54E77F499A0A76BFB995172199189879B86EBFB54CC1B
SHA-512:	7CCC0D2580E7FB92C36F20B438A4698CD78F78878A2A9A013F05599B2C2A665350BEAE0C70FB7D007514B73B34EFAD698669267F8FFADD02502C817F9283940C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c1881ffd4b764dcf9fffc5bf89536047.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:643875R7VbsT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.429675532467756
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmstSHBRAR4s1QGVm+N:SbFuFyLVIg1BG+f+Ms2BI4s1QG8jLkGq
MD5:	F2A0C77A75D6AF82F6F7293E032F91C8
SHA1:	4E45817F2F68C5226D8A322F3AE4F61B459481DD
SHA-256:	FABAFED85264C621629B517ADFD905EAA5DCEAF9D037A6B2F6B45F9875B1E730
SHA-512:	48AE560CB9FCD15D6D3A82BC0EF4C80703B23F6B43BB67400C6FD4C2A72882914E172FB57181A2835760B4224F52C33D801F559BB1D4B04C26396A141A282623
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f6a530b6137c4a8482d5f77144a95c00.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:643878hXqHCU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.431370502352246
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6gOjRGRWnz0jsjOdy:SbFuFyLVIg1BG+f+M6FGwnojNE
MD5:	2106313034425B128F7CF77297A9B3EA
SHA1:	A3D52BC6B5418EE276B636C95EFA4DA860ED48F9
SHA-256:	386CDA634721883C3EFE84976360B6177573149F5DD9BCE1A7690C451A43A335
SHA-512:	D1139A8E262C9636F3A3CB48887B678E2E605D053C588C41ADFBFB57D4DBF89348295CCFEE6EE0B566F38BB2178A43868EF522B5FC3A1B374069DBB7C534168F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=08b0a183ba604d45a333d91a7f39c2b6.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:643879Q2dPeS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.4406163796226155
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmplhBWDRmcSSqDdcD1:SbFuFyLVIg1BG+f+MjhBWDgu0cD0jbVC
MD5:	C43B122341FB9889242A08E6DB6BA463
SHA1:	E793192208053FDA88763602943D37E216A79844
SHA-256:	399CF30A126289806FB24E5A3B59CEC1BDF85E4F185438939A78390E1FDDADED
SHA-512:	336C35E92CB1F0BF38F20318D41A60FC4A2C93A6958116B89CC24F184B77ADD8DF41E63AA32CC3A35CE38B33CEBD737F9A131C0A0E7DB7AEC282C2525B47E3DB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8a4cf149d3f49bd977af2664950d36b.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:6439730XRl7S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.417168972594342
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmykQ33IBWQmsh+sjs2Ax:SbFuFyLVIg1BAf+MykQ33ym8jNALyAZD
MD5:	72BB7F75F2236C1E7EA1BF436439847D
SHA1:	860BC630E0B58141CFA1E32F1204EB7D6507A9CB
SHA-256:	2E08FF4BE6C6B8ECDB94CFD41F26A9EF8210A4CAB78C3F1267BB0387BB2A4085
SHA-512:	DCA88F0FA39A7265EE7EAC8B83A2D399915F7E61D3BCB3A2519DA9D486D53769779F6380AE9EDB9A73D62DA8D6EC901C2893234B03FF2347BF1C79150EE49DB5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8d782de6e04e4481b744214dc1c86990.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:643974j2OoCS

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.493201188447737
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvFdGoBb7CTMhXRuxsjs:SbFuFyLVIg1BAf+M+0VXRuqjNdQIeXD
MD5:	26177FF9C0144A57502435F987590B98
SHA1:	7A7E5CD84511A841B3442304F06379BF0ED6B02C
SHA-256:	D42F3F9B1C92BC367216EA653A3A2F971627C6498596CF915854486517F62664
SHA-512:	CF707262CE68D3E6F91936849AB4C27F2991C0E48D1E135817B77A7D0E375C2EC167F81D1BB795B062884BF2E578A0B9876EB98BC01EE96E883FD5B670F1E1D3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec78c75cfd624841b4916f5c3d42be1c.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:74547kMOheo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.522607896407718
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuIWPdEUI3vk2lsjsv:SbFuFyLVIg1BG+f+MujPcvk22ji4s
MD5:	6CCBDF3BBEC7FD5B1333EFE9B87B0583
SHA1:	D5924D6C59802DE654F79F37BC68D00D90484E86
SHA-256:	220B8E36913C2101628B313B649C3BC91630F2CE3316AC7F3A087F7EC9E18AD3
SHA-512:	47A816B7A68FF003ADD32640888C019674177D0C7FC17006B534E8A6D3985AA4487C26B10CEBDED3204C6DEB83184025177C26E42DCE751B1BA2A53DA1ABA031
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=db505930a3944389a4fa16a7a9710582.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74548CTKo0n

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.533568018966344
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvHRq2DN9gA3BTUNl3:SbFuFyLVIg1BG+f+MZq2nlxji4s
MD5:	978A771345D618106BD3EAB92D831B42
SHA1:	FFBB7DC4A87E7EEBF21BDBA8E7D60F11E1643D18
SHA-256:	44C25E6E028215C0D396C77BACAC8E67C2C72DFFF5A149EC415E13950CFFD42F
SHA-512:	BBD46C63F764C72B18CD586D6E233BAAAC951BE1048CB1974D910D7EBE50FE233E112A732B67D270E0FFB52C9B53C7AE25EAB97AE8F9032563AB2478EFAC75F7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e3d586d909ff4ae6bec23b7d605c327c.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:74590EYgo3o

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4506365638530125
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm57TiH0QKc1J9OVNr2:SbFuFyLVIg1BG+f+MBHQKct/josQu
MD5:	C9C16F141B5C3DD6D2286DF986B9E995
SHA1:	4A42B0A712C4F0DFF740A5442199ED4E6EA847A2
SHA-256:	467E88A5E482BC6FC72430494407FB00E58F4DD7232E682EE02A0475F8748C41
SHA-512:	BBC23231F14CF8D87C542B387758CC5E3FE813E46A2D25A1E4BB5A2165DF9F195AB748CF1E3D7E7DC3E742123595F9E8357723D674A90030321F563EB0374956
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=39f27696bcb045f397cf5a4802a32b30.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:74687ge52lm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3399268122766905
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4HphRAQAkzbAg2jsO:SbFuFyLVIg1BG+f+M4HLWTjtWL0
MD5:	05D6574053C7E13CE855B43B298CE103
SHA1:	F6A7E27A459C9A47D32840465A0B37E2D0CFD1C2
SHA-256:	45502B09B7D8EDADF5681583CAC5EE3A81C9C94568B642672677593FD7189B6C
SHA-512:	C1A3C6C9DFD075AFC7444DF1633014AC9E5D5A49CE95BD1A0100BE34C3B729A756D64DDCC322C046AFC915689A685DBEBBB9D252880B31D2303AE1181DB7C55B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2b82ccda8cbd4505be00f879cfe225ae.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:75850yyMS6o

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.377378222089979
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvLVQdw9BLUWLFHGQt:SbFuFyLVIg1BG+f+MGdwLgHZjdCLKzK
MD5:	62B1A5A1045761E402E181A17A816F20
SHA1:	2EEE8243DFFA54ABF731C8D7227620610B14DA54
SHA-256:	3A5067ADDE639A1B48CA63214819D20B4A83BF6393D9AD42C1A40DA52CDCF397
SHA-512:	9B3199A4A9060E89206BE9AD04A85415E50648509EAC4308DA1E787471D4EDFCAF7C83BCB8BC1CEC4265D4688B2F2C0B155C12177CF518DA2A58142AB2E0E5A2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec9040561e844e55bd837cf383755bc5.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:764388zYy4o

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.426124665381929
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/oNTOeWmSDQG0js2BZd:SbFuFyLVIg1BAf+MABRWmwQDjNTZD
MD5:	8FC7B1E57E79D03F4FF829FACDAA4718
SHA1:	F0A470C68106E25C7219E2D398B04F1D3F919804
SHA-256:	4A5692160A73F714726B0432FE627D5B9A76C6B8E55E4D5DD5D7DE485C810801
SHA-512:	5E703BF7C40325F82F3511DF1FE05A8F443CB8C1D767349283DC10A06FBAB293DF7641C055931DC7564D205D86F922BEC88F2605C262357F1E4B798B2FF8991C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5adf461f9092428e83d57f5d695cb1ed.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76460SYWBQo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.43202469088988
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5+NRHDg5WRxsjswxM:SbFuFyLVIg1BG+f+MgNph8jLTTIWTIL
MD5:	69235089BA58B49D456FAA6E8ACAB0AC
SHA1:	1B447322A8398915C2389C82F98CAAAB3D7802FE
SHA-256:	F335D2688AA596B344FA061DC8BA78D32E45D1E3AB889906D02B9EE6142590CD
SHA-512:	FC081EE4F1B7A68D15104AD6ECE0B9F9960A88331295D34B271E717764E7312EC4DC2D20021DB6DE8C22FDED344CD321461A117E8FEBA472F6A5BACB52FE4158
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3336c637b40f4403bd5f148a53cd6be2.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:76484o0kOVl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.434931578286066
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmvMRQzFrxsjs2BD0:SbFuFyLVK6g7/+BG+f+MUqzRqjNq
MD5:	33A2C906665987A594422476FC866929
SHA1:	6F1BACF2386D6C3D88572B355210B4E371228598
SHA-256:	14A800BF25F461FF19DE01E966FACE18B822E64DFD930892CE0AFBE6B8C6544A
SHA-512:	EFA486F963585EB9B31F3ED267B322FB949B857C364EF63856D66BC54B48EC846CB63DB41BBA750F2F5BBF443CF8D8DE01CA3DE7927F825631FC793174B7CE09
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e107142cf8dd47548536f87c24c7ca13.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:764856sgJVk

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.423185454924767
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm+OyccMtGoEvA+sQ:SbFuFyLVI6g7/+BG+f+M+OycnGR8jNq
MD5:	15BD6DC4CAAE4BBE3AEF33EF1DCAB12F
SHA1:	C24A366E37371D0526B261667AAF729644F62AFB
SHA-256:	FC8EC8CB3A24786D03DBA147A7A1DC579C17D6390A62C93CC27088B89EFBAB9A
SHA-512:	5A0C1ADFD85B928039296F6A21B9C6A4CAEC0D89A4898F0B74E39E90E7D99D9F183973DEDFFEF9700988BB1286C5D18C9AFA2C1A55498649657957F4E4C03E41
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4065cc1995d0448aaa6b758f2fdd126a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:76514PTCk0n

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.536573699333924
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+Mf00hTjFQMzKaBu:qgFqo6g7/+0+f+Mf00hNTmh
MD5:	5297A101CCDE4C3E0B9848F223390CCF
SHA1:	9CF6A1EF6E37C3D01F2164401196A4E2C85DBFF1
SHA-256:	8A1180F8B8585408D095B399A21E1874AF349CC7D31FDC3E3409E40F62457494
SHA-512:	B027D975BE058771EF5972FB348230197B87B8A956BA1FDE3D050DFA2ED7B66291338E8322D579DE344208CAE275283C1350B53CA35CC253EA2C9024011A135D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9758fa11e7a54103be299cbe4bf15e5c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:765158ByBdp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5320080585917735
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MaoDYGW8jFQMzKaBu:qgFqdg7/+0+f+Mao3W2Tmh
MD5:	A4D92C5205D60CA9C5C6295BA33CF531
SHA1:	1F4E3F2339714DDDA53151F51365EC71DDE9C185
SHA-256:	5E9300B7310D14C64E32016A88B40CF5D156AEAC266ACC4ACBCD8D6C9DB786FD
SHA-512:	733B742AB2C5FC342AB1CB11D8E68FB6BDB694CDD8241CD603C9E720EA94C5B5F095C4739435B67FC5BE3953A36E59E0765860F100F606BB4B80345F078C6C8B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cb2c1a98f1724608b515d630d2ac4da8.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:76595Wcc43l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.40633537394721
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M7nXcGfFVN2jdCLKzK:qgFq6g10+f+MTXcCOCLAK
MD5:	F48845057A16D180991669A34E6D32A9
SHA1:	48D8E325D10EAFC44BDC012D53A6CCC294DC2A76
SHA-256:	A781C388C4367C13C8BF0DD5978D4FE9AF1611232393EF4CE3C0C9375599A014
SHA-512:	967BD96F034DA38125676FBC677A90803262E0D58182956F725F00AF81F2AE6BC86FE18D966B2F8C94AF10542A352E002456A47F3C40D711DCCDBFE4AA0DAE55
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5086712c77dc41b0a3e4b4855dfc5642.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76694p2gbrm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.422210853230372
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoEEhwyQclYglsjs16:SbFuFyLVIg1BG+f+MoVhwyQTg2josQu
MD5:	A3ED6D01121B8A628ACE16A5A7999D02
SHA1:	79EEA23CC27FAD7583ABE44AE6E64EB962DA9046
SHA-256:	E1CDCFA1711AD8C2BDEAEB3AA4E01B9BC97F4494583AC4FA35099BCCBBD5EDDD
SHA-512:	3A78935DBCAAB3449E14A71C252DFAD543141F8EB90FF0D0C2ECBD286DFB540469B14D5FEB924BDDF6E29389F72FF4E8B87C43BB37168C190D77B330297DA6E7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bab3ecccd4444095a159028670a62123.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76767XZp2Tn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.412912612188801
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmouSu9pUWBTMbnglsS:SbFuFyLVIg1BG+f+MouTpUGTKg2jLkGq
MD5:	2770BFD8876234B01F919DA705290295
SHA1:	3F06C42FA91FD3790BE9F7D79366284CFA75733F
SHA-256:	24BF444047DF231B6501860BE1AEC877F89A6001443F4726EE60BA9CB03318CA
SHA-512:	521A2B1C931C52B99B724F603339B5906B12D1D6494FD087E00E320FDF0D0478434A5BF2B91F82F8025282945561F990C3CA3199BDB2016159BCC22517713E7C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b0a79e8bf5f043bab8b0413d68d5ca23.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77103jKLpGo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.40214095771448
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrQTGp9BiGEk+XQvFr:SbFuFyLVIg1BG+f+M8UYxg5qjNE
MD5:	38F86BAF1576821084E819BFB1647665
SHA1:	370DFA3E4AF078CA627EACADEFF9A2E83B39C986
SHA-256:	6A22DEBDDD6C84E9599A7CD44DC33D5F6311615422216E6C3B6F160300C953A3
SHA-512:	63220720A0ACC6D1A0768B43CE29CE423B1F7CFC2DA42A8EA7C2C11DB459A04827BC847AFBAF42A05FBA9F1DD8457380A0384D0762ED1FCAB12D621D095EFA59
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a698aac5e4b64231a1d74ca4e6a2235e.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:771049vmEGn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.493942781331611
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsDzhnejEsqjZcHcljX+:qgFq6g10+f+MsDzhnOjkmAu
MD5:	140314254D66D237755598645960C663
SHA1:	1B4BF4032965E48D3C713E1C1755B40C594265EB
SHA-256:	BC349CC7F13FB56067FB49A81A4206BCF229175A0C71C7E88E298BE9C42FD308
SHA-512:	66889EF01D4397E2BEE1E592CCDA6B2A87A799FB7C737FBCA0149F8663685AC07B42E695C49DB5E4EF9DD7CC5A4FC29777408A555CF9FF26D07F13C12FE13D63
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f4f6c320c7d24425a7b47997af5ee491.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77128sPvrqp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.374227889503412
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9u3VRcUvEO8jshKJg:SbFuFyLVIg1BG+f+M8lp/8jbVC
MD5:	C470E0B446B126B13AE877FB9A87E3E8
SHA1:	EE813CB3BB4E07BAE7723C6F00817BA323C89F52
SHA-256:	1AE96C21AF296E4CCCCC31C7361B1DBB65B228F67E3583E70EF920342D57B8AD
SHA-512:	2EAB9C5ADB531858D2EF4A95B40A7F28BDCE523E51C529F085A81221F884549ACF96B4B696964EF68DC858E1C4117114E1811A819E274B1C96C3A750CA782E8C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7308140e1960494aa149320b8cd49c98.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77290BlblFl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.436060679141532
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyErBmcurBdIRAZjs2Ax:SbFuFyLVIg1BAf+MyEVgr1ZjNALyAZD
MD5:	CA2B0DDBBB16B623B9F6E633F0657B88
SHA1:	E2271FA2B19A5C8B3582ABDA69F22B498A3F4374
SHA-256:	68053F20A1887E6F9337D32643E5FF17D6D9C5BCD37F585DD7A014B22C49BFDB
SHA-512:	36876F6254FC660AB89C718EECE8CE8EE48E1AD4EF2E24454F161800CBBD9B4D5BF09FA426161EAF30B4C772EFA980606619D12E6B2375D2812C300F3B867FB8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=86e2f0b1b69d4e90a583d84083ca4a07.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77417SXb4lm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.483249219395084
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4wLdDaWdTh2lsjs2BbM:SbFuFyLVIg1BAf+M4Mk2jNdQIeXD
MD5:	FA61FDE837BB574C45563D3C8D154571
SHA1:	35AB5A8594A601FA9297C3120F765231E9E26BC4
SHA-256:	50E12A2052869045A2E1AF1283A9490FC77C58FE4CB96B1F8D2749994F64757A
SHA-512:	E7A8076EE43C1EBCDD3C11B13F3D0CF15BBDDB808781500F61C72B358B9A667E41DD1959BB05E80E52C3A319FE9E6D04EC3825056B1572BEBCDA9B0476D3DD7C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2382d84b8ffc44bab840c86676251c20.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77510s1Mwfl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.44654945075779
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+7SP0X2Tr2jswkClK:SbFuFyLVIg1BG+f+M+7mu2Tr2jLkGq
MD5:	781C34BF84A12152B6D86454E6C6C9C5
SHA1:	0DA848E777B25D2838DC7AFF1D3EDC691886EB80
SHA-256:	1996D645B86725CF53AC187077582D6FFFC8E79CE17B8CE0618B359FA6D04759
SHA-512:	8C1716C0464D4060145FAE53360E45460C102F4DCCE9F583C125FF7A0E655E77A4CF976199C52B7AA8B7172949BFA408DB48CF57F35DE3CC3675FF76374F024A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4f76ba89e7f64b13881f2652d4cd1826.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:775154YIZRo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.444876775294799
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M55Nf0hTjdCt/rRMtq:qgFq6g10+f+Mx03CDL
MD5:	1AA7DD5FF8211EAA47550B0CB1473341
SHA1:	06ABD1D2BA77C8BDB6C615D424BEDF54190BE1BD
SHA-256:	0CC3194F6F23CCC1D3AE82F97405F989E65832109300ABBE1B29B816B3DDF074
SHA-512:	622BA29233A158D39157A23C75A854C52D9B26E0D72114DE1FB4C9D27F1F30295CDF33E30516AFEEDD7ECD63A0C53F85BD42153C6B3720EFF4BBD9299890267E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a1d97708c93b43b8b1c49dcaf7b0533c.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78316mgh9Yl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.473098937641168
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MefC0bUWsZjNdQIeXD:qgFq6g1af+Musn2D
MD5:	9113424409686284B0EDEBEF926DC18D
SHA1:	225A07AB9516642BC49FBE225E07BEA9BFD15559
SHA-256:	5BD35FC5BF95B84AFCFDB214E5ACFEBC860C318836D9F8E669ADC5AE8556EE63
SHA-512:	CFAB50F1BDD2F1A10391AADEB236F6F82815A2C42FD3C391D2DE00467E2AAD60C5900EF2431E0004FD759749F6751CDBD4C06476A2745BE67DF8F95B1848CC26
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a85fff6064964563bac467d84b7406b1.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78392do8Kfo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.388981333204725
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmujbRG9ooFlsjsmNzi:SbFuFyLVIg1BG+f+Muvg9og2jdCLKzK
MD5:	D1A951A1F00C4050938B00EAFEA2172B
SHA1:	7AFF3E44C7C97049C2E185DC0BB0372669FF944D
SHA-256:	D957D1FB04364066CCAB1ED431141B822F7DD847262AFC2A9096E5856675D1D6
SHA-512:	1C31522C7A86B2363806155A809C1DFC47A05CCB21DBD5782FDBA4D441906868222BA3093C0DB21799F719FFC9A345ED9401750A1ED7C6E316472CC496844FBF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dbf8ef3402fb4c3da3b7da728d0669f3.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78500osthCo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.421936876340656
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6EZARBiATjdCLKzK:qgFq6g10+f+MzZvuCLAK
MD5:	34DB5E9378AFE13A0254ECC10313DF49
SHA1:	FD0360BC3CD82B67055F8296690327F5287F8862
SHA-256:	5B522BB0D78566B9FFB35E44D86CDD5575D4A7871D11612C5342968D0E102888
SHA-512:	8B318E51CEA5CF802D424CF632288321F9E05E08C0FF550CFF89C4F4F1A9CDD800726C9DD6F851E4D1582D555D413A0ABC248906436E0BB60BDF7520E56574EF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d27df68a2034f9785057b623c692b8d.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78510oEaECl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.396794790772208
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyTWDkHVgEY8GGXsjx:SbFuFyLVIg1BG+f+MyTWi+EnIjosQu
MD5:	CFD28AF8EAF8EAC91B1129B78C34B8F3
SHA1:	3E238CB5F574576749F150E6F36209DC2868389F
SHA-256:	51A344F8272C8CCC1B5C04410F7922F9AD50124BA4C580980C95947A9D438732
SHA-512:	7370F8B8EE3A62D2621965BF3E84B0D91247115BCA5BB5321453C3FAC738A406D582E7AF7ECD8B85E75EA1243A14B3D3823C0EBBFB91E821BE9E52BD0E0C9C1E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=85983f48fab04db3b11de44d386588ca.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78902kgspAl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.467492665634145
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+My8RfBCujZcHcljX+:qgFq6g10+f+MFWwmAu
MD5:	56364B5731254B559A9E45D344F65BE3
SHA1:	35C8F3D45F60D6BCDC77FCACD616E9FD8868F4E6
SHA-256:	211CFF590CC56483A48987E26DEB0A408209BFB62BDCDB3E59EC45440F3DD81A
SHA-512:	9016AF3B4B494AC72C353A1B059EFDFA808FE50C3133C0A95C6A8304AD1AA3D5D13FCFF77BD1F923746CCB87946B823C7963520C447DE4764EE2DA43DB1E4D08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a79f7c4af0a04818a7ec9952c3953d04.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78929jFmPTl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.43452408868137
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuGRHQcSGjswsjs2ALAQ:SbFuFyLVIg1BAf+MueQcIjNALyAZD
MD5:	B33951C357B95A63FB7F8968F3933CAB
SHA1:	DD937F5A71DACCBB4ADFCC3AD312DAA99ABAAA16
SHA-256:	7A1CB0ACEC1A7BC659AFF0D38FD2614B84200D9533BA9023B788A5E25135D4BC
SHA-512:	01B8EADB21E5CCCCA6A82ACAC6E3DF9A36464038C6A9E151733698719AF723477CE86FBC4518FDB825EED0FADC4AE3FA93EC8E397F3AB6F18565C2F398C46A86
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=daf5f7664a014a0e8b3d9ad6c09b2c5c.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80115W7mEW5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.531642191419836
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyBxPHHCvcu3gBmvs+:SbFuFyLVIg1BG+f+MyXPHH3u3gBjji4s
MD5:	C5EC7413CC5F51B625380ADE40EA5C01
SHA1:	B66575BAE51982463723C0F77254BB309ED60FCB
SHA-256:	0F9119138707B1E4E8A2FB7C22F41D6F2F04B04681CF53B3D119D6E3256D9D04
SHA-512:	85108F67EC550EDF86B311C49E6E435E57237D40844864B0148A467AA19A4D7D2E4FC5C5DD6AF7CA99D76A05B77F54B9E15E8360079C4468D6B504071E7C653D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8f842c16bbe24799a928c4eeb11e6d70.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80116xeOKd6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.48300472698358
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuWHGAjdjZcHcljX+:qgFq6g10+f+MfHGM/mAu
MD5:	6396D6B2D78FF65409F87043BCD35B9E
SHA1:	703E8F7311F5D59B12DC43C77B37E7F82DC3D283
SHA-256:	4EAAC1591A6A1661B8340825CD66340AF84408BEBA3187FDAC665FFBF1CE2DC4
SHA-512:	A0442E686A1D05DD3CDE30068D5CC67059EC5BC7A9AF25D45996F34F668EC6F5EECA38B0EA18FD5DD07BAB5B262840FE693B6957CF50B973C6F4A3B18A673234
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ddbd08c6b5a747f58c1c52d5ce976a17.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80117su4y92

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4004734463083945
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8QeUeZic6jdCLKzK:qgFq6g10+f+M8QbcQCLAK
MD5:	53E489EC4FB116BB99F6F769B760DD3A
SHA1:	5FBC0BD0D712E4323A9E9A40B5C08451117363EA
SHA-256:	1B6CDA42178637AB2770A3B253DC17DCDF5B35238A5E503417496F2193640388
SHA-512:	612278F5269A719AF3A4EECE59A5F2BD16FA7199F11FEC52C113075596E8835300C4A3BF86BB53A4BA62BB44283CB926120C2D66B7C902B84B45EEAD6BC94903
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=62f967139f674531ad68e714516f5394.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:801183FlSP3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.414917254175652
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+iAmHIC1WNTjs1Ha7:SbFuFyLVIg1BG+f+M+ruW9josQu
MD5:	68F98A34960A6BC713AF1DD70B873637
SHA1:	CD39C01078BF4CA2E1AF871EF56FA239C97E47F1
SHA-256:	276116FC225D38593AE49A2FD99D40AC763C4A549B8580D489A22601E5D90891
SHA-512:	79B242C7AEA46EEFA3EEED8DC7BAA9D6AA026828094C2CBAA2E826A4C0DAEBA7E91944963EE3F543608EEC309636C78E9BB581890F2F62890065B879E467D059
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4b73253387bb4fe0bc7b063dba9a32f5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80131J5FPO4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.463356163362518
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuEoMtF2jZcHcljX+:qgFq6g10+f+MT9fYmAu
MD5:	36DD09D28FC13750395FD9640A545459
SHA1:	545078DE66A8E5EB0BEA321574AD4155E6593139
SHA-256:	C054CDC25B61132787B4F1D26105CE865AB6CED2344A33736EF390ADBF6836FC
SHA-512:	F2C2CBD9EE03CDD7AE9395DBBF694634845CA0515AEFCA6EEF19D76B60DBFE7946966DC8B8608C1B73B4B0B9815AA169E82D8ACE04CC5281725EE5C6E2B77F76
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de1edfbafc58479491dd78ce61bd490f.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80132BlLh62

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.384700928089773
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MPMiGbTPA8BTujNALyAZD:qgFq6g1af+MPMl3PAGkIZD
MD5:	A6E36CA3546B189AFC76878AECBADCC5
SHA1:	AE381850AFE7396262A3ADE55FDFDD0580F62A4C
SHA-256:	652A4BEFF667A86F9A59DDF42E9535CA23AA4E7672BD7F3B6757FDBE273E74A3
SHA-512:	372E4C82B2EC8EABA8CD7314A5E3254D6681B21165AB9926F20E78E1FEA4976583DF305EEB6B84DC13BC0BA7E5AEC9C2DDB3C798232CF645619F446C2162C608
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ae5c7210ebc14ca186266e126d6e78c1.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:801333KrIj6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.388189039760589
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5IzTVBd2ndWBXkJ8S:SbFuFyLVIg1BG+f+MW/o2xjLkGq
MD5:	5B6CAD8D60BFCB9D553B3A42874C8DCD
SHA1:	AE84A0CD03C17C448EF6F66D4A97D636B4701BC1
SHA-256:	685A60B0B1933691907B097D16DF4BE9331719ADFD54429DBBC4F4AEA793B655
SHA-512:	2248A095A948191FF11E61C4C6642743E5FB671BE8A250040BA1D02A99BF9532D8AED795A24CB5DCC2BA96A06DB6029AFE6C64F6B50F3BE5821AA4650883EA85
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=36a3efe4370c460d84445718329e2904.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80134h2LV06

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.481200861548972
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm49JojbHTQ+4vsjs2BbM:SbFuFyLVIg1BAf+M4jko+RjNdQIeXD
MD5:	3FB9B9EC3DDC14AA0DC4B947F2C913CC
SHA1:	1D1411072FF9FD23AD6F85D34567866771E4B82C
SHA-256:	88E27A7142C68D135AEB2A4FC0283F1A07634F7AE798A97FD8F2344D42678B83
SHA-512:	CA80C0A6722604462246F7D21FE626FCD50A41FE0EA32410600474B21CA0D2F2CB72447076C73E9383895BABBEE0C793FC01B3614D15C4EDF4D783559CD4CC71
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2774809fefc04bd0842b6df921cd51ec.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80141GMMES3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.4285881075712386
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsGDS9QU1UbEHuDTc0ZH:SbFuFyLVIg1BAf+MsUS9QU1ri9jNTZD
MD5:	E4FE5052C60F79EDC7685552E7ADE81F
SHA1:	229313A9285327742699B52F92D42B7D77D844C6
SHA-256:	89FDDC42E9D0E570A6102927B58CFF0FA5C4602DFAB2C92693F77598DA0FD1A2
SHA-512:	D312E12DB7ED1A8AE4FBD6B3CDAA68D432F205F263893B74B5EB07AD77F1C6E3AF4B469E5A1FF5BA13733EB99AFD85833A5810398D17B4CA10E379350FCBCB6A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fcf79e625162415f9abacf018e47a369.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80999dVl2z5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.443241177000237
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyWBWh32jLTTIWTIL:qgFq6g10+f+MDW16EWEL
MD5:	666B8BAF8A81CDC915DBD81D354166F8
SHA1:	9A646D94F72E98B8A3ABD94FC6E878AF0F984DDC
SHA-256:	2E00099D490FA8F97756E425A8612ADCFCDB114465C247A06D8EC2E6AD36E10F
SHA-512:	26F59F06FFCB7A1C5F76FD225AE2684E20246D0E634D0EB1126EEC31E8CDC0695973175226792A99A2F05181558F4543BB803CCAE3E6BF4316B41ACCB26ED277
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=868fe88f3f824655bfd2360e695ad34d.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81026YLcj66

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.377910267562744
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrCnX7NxBQ3F2jshKe:SbFuFyLVIg1BG+f+M+nrNxBQsjbVC
MD5:	231326905019073DFAD19A19CF9F86C1
SHA1:	EAEABF0C958DF5391A929C4F9284E7EC38250D30
SHA-256:	E776589B76AEC10CCA51BC78936D0A8791D1B032944E8B5032657DB39E874C01
SHA-512:	0C9AB19A2C07DE078FCF45632B2BD05D7BC3B83D4B60C98D82EEFA194689A535507C1A39AA1540482EF8F0AD3892A6E8882FB8512F1344C6B4A78F35C5917106
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a52d4d3504904559a99b3d4237e17b57.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:81056JMNlo7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.409057826708545
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/hidFHh4Juqjs2q:SbFuFyLVK6g7/+BG+f+MwPBLqjNq
MD5:	1498A7385C2B3EE1B72ADEC9C7C35F5C
SHA1:	00183B54A419E5BEA95127C51CE906748344C17A
SHA-256:	FE5F1236E580B290D1E5DB101CF3099DB1AAE448EEC3EB355C1A4E0B35DC858B
SHA-512:	7BA0A3664129295D6E04275FC1ADFDA71A868C9FE1DAC3F59222825FFCD9FAFED9AF8A32200E6E22B75F789185674303B2171A39C50D129B5DF7AD2432292D66
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=577968de7e0e4ea4bbd5a965319244f7.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81057O1JTf5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.43271515005258
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmziDNgSDD1FchT1a:SbFuFyLVI6g7/+BG+f+MOFYHg2jNq
MD5:	ED86714E2871E129ADF2B7F904885FF1
SHA1:	4E7E799A2791A3184019531B9EC363EBC9423228
SHA-256:	32DD7C15A4E07A02AA40D19D4667F9B58E711EC2090F9B29809C21CC9D9FEF35
SHA-512:	778234D7B26253C2D28544F0CF92F2A98724A5C511FAC751D8F92E911C1D667C56F361F2BB46A31491212DFF72464E0684D58188824093C34AD9B48302091800
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=962e59fada354c71b9fe58b9dd46e54c.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81089H8qEp5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.50753978739368
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MFAWqjFQMzKaBu:qgFqo6g7/+0+f+M34Tmh
MD5:	C14F28158BE746527F9DAED943C4DEAD
SHA1:	BF4E5EE065202C93B928E2537731A18C9BD44366
SHA-256:	5412B6D5AB74723B0BCA2D381002AD11C63ECFC30A6EF66564E65E2353E6AFB9
SHA-512:	7A0E2A6D776D53710C8EFC3B188B60745E112E66E88F4AB850EDA418433C1C9C371C8406932AAF45B58AC241C81328BAC3008824FA954A4A9F92CDD9E5252EF2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=35b453f2c4fa42c0bc2905f8acd55f6c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81090AhjoP4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.479443908679918
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MsIJgGt4jFQMzKaBu:qgFqdg7/+0+f+MskgGoTmh
MD5:	494390564414AE67F416FDEC8C123372
SHA1:	D503E1E090D459C690495C0544F938E3DA95CAE9
SHA-256:	BE3D83F49642DCB496F4D98748FB4EC6CC5054919FB5C63C215C5FDE7CD19925
SHA-512:	4AD5EEED68CF74B04BA06C7916CA3634CB468C963F72F3550599C9CCF7345CDC05E22D0F5CDE2B74A791F2D54307EBE3068417F38DB65F9E28142FFE6DC20D6D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f140e9f0b0b34ca09bc2627bd6b0aeff.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat02qU6aS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0Gv4d5a

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0QLb53t

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0XyBEbT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0aWW2ng

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0eaatei

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0m3Qo6x

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0o1Y00u

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#127JZUL9R

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.326557187896913
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGvT3IY4nsk5206qodhSI/n:SbFuFyL3BVgdL87iesnAiRJgITYAk5tw
MD5:	5B779A320D0F94CF45D4CC8B805D67CA
SHA1:	D730372A3975266931EE3EE3ED080D3B8430EA81
SHA-256:	FBD2FB4B94FA68E215BAD97974694EF239174989C7A29502F32AC5D9988E53DA
SHA-512:	5FEE5D5B9D3079736AAAC1488E09A481FD4C5B8883C33C91ABA0CE7A1956AD7B5E6C3824382B7A8C495F82B81089FAB1AB16204856281BB6EF8212CDB3A120FB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733907536082614.MONOTONIC=481682678.LAST_SESSION_TIMESTAMP=481764342.

/run/systemd/users/.#127Ololxg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3097542560391435
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8ZBgwQ8mT102thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEDgwAlthQHtPYq9M
MD5:	A5D8793E6A90888C42E87783FA4AE26A
SHA1:	7B610020A7873F97557BB46527C01EB52FCBA409
SHA-256:	64D28E1FFFC48452F68BC826D93EAAA20DCF86C6BEE861C03770906BFA153C9F
SHA-512:	39875E5313784062F5F118919283E4952A6EA29A936DD08BDF13758D1D7A0F1735B808097EB2D0552C4AB1F965B735F5EE75A71050C6CFB866D9EE92FCA0DA11
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14378.REALTIME=1733907631258193.MONOTONIC=576858257.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127QYHcey

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280092809313611
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffizgMriQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBagMGjthQHtPYq9M
MD5:	1A08B9C0DE9329486C57129ADA0BBBF3
SHA1:	1983ECA8354F84FA2221A81D382A713891A223D9
SHA-256:	9C0681CFA6FB2BD8DA785ED50A6DF735AF68F215022047A034F969ED2274E263
SHA-512:	7ACF59314C548BAA1165AC6D1FF0E4472DE7038E151E5DEF6E69B2FF27C0479109A7BFE21BDC27AB540B63DCC3AE99248C5E45B798A7FE6915A4940946A50A66
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13641.REALTIME=1733907571931845.MONOTONIC=517531910.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127YTaTxi

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.501501010609081
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8lHTgwQ8mTi/gt6qQG:qgFq30dABibBEpTgwAe/gIqh
MD5:	3A7C4AF7EAAD8685BF675A58DB0E5326
SHA1:	1306ED05F97C3E7040F0C4D48A7109DE9C35F94A
SHA-256:	0F8AF6FED7DDC717574347BAB93F5E279EFB500F27D670D37123740044F8DD53
SHA-512:	6E3EAE68C12A4F9F69A388126EC0B0552C0E942483CE57978C247037EE0F2BFC661215DCEBFF51B2E4E6727BBBDA67E1B2C5507B48DC2820F51716CE7E7CB0E8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14440.REALTIME=1733907631258193.MONOTONIC=576858257.LAST_SESSION_TIMESTAMP=576926838.

/run/systemd/users/.#127d9f7Jw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.437540773909459
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffBgMret6sjm:qgFq30dABibB5gMaI8m
MD5:	293669B65A2AEA778965CF51150DC9E0
SHA1:	69CA4B0908DCC32A2515B8B4310F55DE37ED43EA
SHA-256:	BAFE6632ECB9DBA97E240DC7E4ED807C2008AE84DA96EDC6626F5CA554538E73
SHA-512:	C2AB94DFFF500AF80668FE9506A2DA55DA6D6BCCEC106E22F4A8B8C4DE05BADA1AE452E08477EE8F48D5DCD53174A2479D4856C31E02CF1815DD4005287E6E3F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13703.REALTIME=1733907571931845.MONOTONIC=517531910.LAST_SESSION_TIMESTAMP=517596136.

/run/systemd/users/.#127mqinSg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.3097542560391435
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8ZBgwQ8mT102thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEDgwAlthQHtPYq9M
MD5:	A5D8793E6A90888C42E87783FA4AE26A
SHA1:	7B610020A7873F97557BB46527C01EB52FCBA409
SHA-256:	64D28E1FFFC48452F68BC826D93EAAA20DCF86C6BEE861C03770906BFA153C9F
SHA-512:	39875E5313784062F5F118919283E4952A6EA29A936DD08BDF13758D1D7A0F1735B808097EB2D0552C4AB1F965B735F5EE75A71050C6CFB866D9EE92FCA0DA11
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14378.REALTIME=1733907631258193.MONOTONIC=576858257.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nmJ7Qh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nx7EZv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.280092809313611
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffizgMriQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBagMGjthQHtPYq9M
MD5:	1A08B9C0DE9329486C57129ADA0BBBF3
SHA1:	1983ECA8354F84FA2221A81D382A713891A223D9
SHA-256:	9C0681CFA6FB2BD8DA785ED50A6DF735AF68F215022047A034F969ED2274E263
SHA-512:	7ACF59314C548BAA1165AC6D1FF0E4472DE7038E151E5DEF6E69B2FF27C0479109A7BFE21BDC27AB540B63DCC3AE99248C5E45B798A7FE6915A4940946A50A66
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13641.REALTIME=1733907571931845.MONOTONIC=517531910.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127oOgVER

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127smAJzR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.310692775565705
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgITY42thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJgI07thQHtPYq9M
MD5:	E07647EEA274818B077FC5FF8C5565DF
SHA1:	56162B3F2246943F881E8DCA21412303E0531BD7
SHA-256:	944A5B7012679B81A31E660563DBA05A2FB69F8359988B7E21DA5169F086526E
SHA-512:	711184690496E9229E9D88700CC782AB3EC3A53B85BA6EC6970CA6EDF5B381D5030D6819513AADFE913E348780500BBB94EB1920B1DF2225B2B1576F1557E4CA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733907536082614.MONOTONIC=481682678.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127uWWpvh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.501501010609081
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8lHTgwQ8mTi/gt6qQG:qgFq30dABibBEpTgwAe/gIqh
MD5:	3A7C4AF7EAAD8685BF675A58DB0E5326
SHA1:	1306ED05F97C3E7040F0C4D48A7109DE9C35F94A
SHA-256:	0F8AF6FED7DDC717574347BAB93F5E279EFB500F27D670D37123740044F8DD53
SHA-512:	6E3EAE68C12A4F9F69A388126EC0B0552C0E942483CE57978C247037EE0F2BFC661215DCEBFF51B2E4E6727BBBDA67E1B2C5507B48DC2820F51716CE7E7CB0E8
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14440.REALTIME=1733907631258193.MONOTONIC=576858257.LAST_SESSION_TIMESTAMP=576926838.

/run/systemd/users/.#127vD5dFw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127wFgSBw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.285693319368825
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGrUM42ShxH206qodqjc7Tv:SbFuFyL3BVgdL87iesnAiRJgMret6sjm
MD5:	3655B50B6B22630C195A3062FF39CB88
SHA1:	41DCFEEE226C9A0F964CD8167B47C8DCDE5718AC
SHA-256:	49DD656181882BA1C511BAA651589B567B7D2346BABE20ED4677DD1F42F4F946
SHA-512:	D7EE2EFDB71DB909B335267E5998B624F831B785FC1E5D16B3D3E2B93307C6675FCB6B1EA0E82B823646477A98D5C4BAF446F9AF2E225407CB798A35CCE32B6E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733907571931845.MONOTONIC=517531910.LAST_SESSION_TIMESTAMP=517596136.

/run/systemd/users/.#127whCabS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.310692775565705
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJgITY42thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJgI07thQHtPYq9M
MD5:	E07647EEA274818B077FC5FF8C5565DF
SHA1:	56162B3F2246943F881E8DCA21412303E0531BD7
SHA-256:	944A5B7012679B81A31E660563DBA05A2FB69F8359988B7E21DA5169F086526E
SHA-512:	711184690496E9229E9D88700CC782AB3EC3A53B85BA6EC6970CA6EDF5B381D5030D6819513AADFE913E348780500BBB94EB1920B1DF2225B2B1576F1557E4CA
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733907536082614.MONOTONIC=481682678.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127xHzP7f

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.309054995037047
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGjXQdFob5wTu3xk2g206qodsh:SbFuFyL3BVgdL87iesnAiRJgwQ8mTi/M
MD5:	1269A12B56368085A65EEA17D6904636
SHA1:	B284D86D48B8ACE319C3825D27720893914B71E7
SHA-256:	BDB199897C8802577D6F94B56E6A3FD3E900B0587B82FDE731F6EAB2D58CD97E
SHA-512:	39F45524FFE488F48B6C924FFDA2FF86DB41F48706C5A189D3E738A1C1D38BE986BB5BAB3B2304E8A817C2BB37BE9E2082CEB8B827AC5563D4E8DFCCA259145E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733907631258193.MONOTONIC=576858257.LAST_SESSION_TIMESTAMP=576926838.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mWXv:mW/
MD5:	CC86E8B2ADCC41661F7F51569DBC7C36
SHA1:	E57754853ACB418BCA945E5BDC67BA4D5EBDB921
SHA-256:	AB8B5D51967EA2D7C6A9006206EFD9484B33B6D61FD7353DB164100EE7930032
SHA-512:	41BC7B5AC7F933527575359A3A5BB5F1A4F273EEC59665E46F5649E8FD88010E98BCFB85D03DE67A0D341F9D6D2B613F2F9D918C9413E2DABF7617A7F9C02AD3
Malicious:	false
Preview:	7032.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mdtn:mH
MD5:	AE971F5145D20264D6A7695C4F91685F
SHA1:	C78A90F87A4612A7BDDAD419B6F7DF879977BCF1
SHA-256:	93438D7E76DDFB404B3873262C38A50A9E04FBB71EF9AC167C00A1A3AEA7EDE7
SHA-512:	E049ECE9A3F1AEBE531F3BDA4B9E516F20B76C08C95DEA72F11611E1532A055EE8125395EE353F29A7312900EED32CB85B6CB48B64227B540F39EB708C575AAC
Malicious:	false
Preview:	7088.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:5CsXlXEWtl/HlFX:5f+ylflFX
MD5:	955B4DCBF3A9D5F1544CDA9348DCD350
SHA1:	3FAA931D4DEA99A8D04F623C118736C24C57C602
SHA-256:	4AE2ABA1D8C89199D06B9A20ADA96C9DF673B8DC3803D22287414E3F15F5F698
SHA-512:	DCAC473358B9928CF1D6DF4FEE59FF48E428606C81B749EC5F4F5AF391739372AFB27FDFDEB2A4B8EF35333DF186195DB4F867D447859979FC933C67F4D0CB79
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................TYgUs......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcWv:mcWv
MD5:	C085097E63D0F5819D7E9FAEA49411AF
SHA1:	C500212666296E27B2FB91A84F89DD6E2A9DD2EC
SHA-256:	500DA583415D79DAD36098CA6A8BA4A2A42A1D6AC9AD83AAAD61DF2C4BF2B8DF
SHA-512:	06160731F675C5DFF197EEC418DE48CD176A6404B52D9D489439220CDA1865801467B4CA71A9289ECD11790A75C208D195C15A8D155C59A32227D8EC43848436
Malicious:	false
Preview:	7093.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mdcn:m6n
MD5:	F918FC2B226F3FC2FD9B43609BC49820
SHA1:	34B6E1E889FA7221B87F40763279F883CC73B061
SHA-256:	67DC2DCAF68CE091A77766E52076ED623FF9C3DE4F6E7E13973D164829BAB595
SHA-512:	7ED32E9C4FC2DAAE8B3A2C0DE1060C7AA19675317083E14448AD0DC6F7174C0A891577E5CC9021CA70352075FD0BF4A8C2DFC08C2E20BED201EB3EE6D8935D22
Malicious:	false
Preview:	7087.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	1.8464393446710154
Encrypted:	false
SSDEEP:	3:mSVvA:mSu
MD5:	CDB4A106CA168E00F4194203CB16F0CB
SHA1:	AB3D32F6354D9116456CADDF0F87A772C4E50281
SHA-256:	83AD606272584A16BD56F7912E67F3AF5DE45BC72BAF808D7E953790C1901DD6
SHA-512:	A475910A3819558C93030D92E395B9E2780F01D61CFF4D8A1B571D1347A4BD75F0A0DF15B97EB220E6790BCC32302BD3D28213B23EB2263ADB7A7331A7AD9062
Malicious:	false
Preview:	7070.7071.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mdtn:mH
MD5:	AE971F5145D20264D6A7695C4F91685F
SHA1:	C78A90F87A4612A7BDDAD419B6F7DF879977BCF1
SHA-256:	93438D7E76DDFB404B3873262C38A50A9E04FBB71EF9AC167C00A1A3AEA7EDE7
SHA-512:	E049ECE9A3F1AEBE531F3BDA4B9E516F20B76C08C95DEA72F11611E1532A055EE8125395EE353F29A7312900EED32CB85B6CB48B64227B540F39EB708C575AAC
Malicious:	false
Preview:	7088.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcWv:mcWv
MD5:	C085097E63D0F5819D7E9FAEA49411AF
SHA1:	C500212666296E27B2FB91A84F89DD6E2A9DD2EC
SHA-256:	500DA583415D79DAD36098CA6A8BA4A2A42A1D6AC9AD83AAAD61DF2C4BF2B8DF
SHA-512:	06160731F675C5DFF197EEC418DE48CD176A6404B52D9D489439220CDA1865801467B4CA71A9289ECD11790A75C208D195C15A8D155C59A32227D8EC43848436
Malicious:	false
Preview:	7093.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mdcn:m6n
MD5:	F918FC2B226F3FC2FD9B43609BC49820
SHA1:	34B6E1E889FA7221B87F40763279F883CC73B061
SHA-256:	67DC2DCAF68CE091A77766E52076ED623FF9C3DE4F6E7E13973D164829BAB595
SHA-512:	7ED32E9C4FC2DAAE8B3A2C0DE1060C7AA19675317083E14448AD0DC6F7174C0A891577E5CC9021CA70352075FD0BF4A8C2DFC08C2E20BED201EB3EE6D8935D22
Malicious:	false
Preview:	7087.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	1.8464393446710154
Encrypted:	false
SSDEEP:	3:mSVvA:mSu
MD5:	CDB4A106CA168E00F4194203CB16F0CB
SHA1:	AB3D32F6354D9116456CADDF0F87A772C4E50281
SHA-256:	83AD606272584A16BD56F7912E67F3AF5DE45BC72BAF808D7E953790C1901DD6
SHA-512:	A475910A3819558C93030D92E395B9E2780F01D61CFF4D8A1B571D1347A4BD75F0A0DF15B97EB220E6790BCC32302BD3D28213B23EB2263ADB7A7331A7AD9062
Malicious:	false
Preview:	7070.7071.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mdtn:mH
MD5:	AE971F5145D20264D6A7695C4F91685F
SHA1:	C78A90F87A4612A7BDDAD419B6F7DF879977BCF1
SHA-256:	93438D7E76DDFB404B3873262C38A50A9E04FBB71EF9AC167C00A1A3AEA7EDE7
SHA-512:	E049ECE9A3F1AEBE531F3BDA4B9E516F20B76C08C95DEA72F11611E1532A055EE8125395EE353F29A7312900EED32CB85B6CB48B64227B540F39EB708C575AAC
Malicious:	false
Preview:	7088.

/tmp/qemu-open.jUHFvF (deleted)

Download File

Process:	/tmp/wheiuwa4.elf
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.110577243331642
Encrypted:	false
SSDEEP:	3:Tg+ARhCoHJN:Tg+ARhCaJN
MD5:	C25D7304E0D3B509F3356759E87FD6BB
SHA1:	C97763A9AA052001918429BCCE1F39CEE1E031EE
SHA-256:	E5C1C946842FC5C5433BD904939E3018B0B62DF5F1FF888F0ECBF5C7C90125A3
SHA-512:	1D0E8BC31F82785799CE6D8851BA604819784516C246F5CB6D8DA12C63CB6DCBC256D0C6E63C1FE2E02E608D349286C2813D2D3C286DD2B1007D817C053114FD
Malicious:	false
Preview:	/tmp/wheiuwa4.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.3U2CY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.D8UBY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.ES6LY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.894411394918692
Encrypted:	false
SSDEEP:	24:T5/Zea/5NG/55rioeAvzeA2+VpMCe/0pYrghTVJrEgHrCQU:d1wtFfvzffVpMCeGYrgVzrzHrCn
MD5:	79BA397B31B7EB7C8956ECBE02F565D7
SHA1:	5721ACDD80B81C18DA2E69717A0286A80CC78259
SHA-256:	6999DD4EF8753EC0A5FE8CD09A0101D6F34AA9F893E46993F62546563BB43BD1
SHA-512:	1548496BDF178D62B09EE682475F74757A4564CAE590912B0970BCDE74607D2C2040000279DFDB4370F7DC8666E33251C8F27FC08DA08802D809139FD64FDE0E
Malicious:	false
Preview:	Dec 11 03:00:15 galassia systemd-logind[6944]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 11 03:00:15 galassia systemd-logind[6944]: User enumeration failed: Invalid argument.Dec 11 03:00:15 galassia systemd-logind[6944]: User of session 2 not known..Dec 11 03:00:17 galassia systemd-logind[6944]: Session enumeration failed: No such file or directory.Dec 11 03:00:17 galassia systemd-logind[6944]: Watching system buttons on /dev/input/event0 (Power Button).Dec 11 03:00:17 galassia systemd-logind[6944]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 11 03:00:17 galassia systemd-logind[6944]: New seat seat0..Dec 11 03:00:31 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 11 03:00:31 galassia systemd-logind[6944]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Dec 11 03:00:31 galassia systemd: pam_unix(systemd-user:session):

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.3755317395372328
Encrypted:	false
SSDEEP:	3:F31HlB14fAE/lJ14fAc/:F3741/h4
MD5:	6CFA8E6A00BBD15CBE488A1703031C51
SHA1:	49A18FD8D8BF0C78653AFF22FD44C97E209466D5
SHA-256:	6893A5483B30F1FA8686899A507615DBE15FB3AA563DFB7ABF3CE7B6582BB85C
SHA-512:	D8075EAD897C30CD7619C90F1FBEAC62FE209B7E4BF8E59C0E4A3827E1CF26F8604AE1CBFC4B28B13CCE1D359D1F04A4116684C2AB5330D1A229A62C0E8BF4E5
Malicious:	false
Preview:	LPKSHHRH................6l>...I..:.i.6.................................6l>...I..:.i.6.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HllKzlltHKzVlt:F3Mzl6zV
MD5:	AC4349B763C02650F36E102B286F476D
SHA1:	6568E208A88937B667E12E2FB3A0EC96F8C3A72F
SHA-256:	D8C01242654B9E04777182EFFD559BAA9C4203CE988026CA700C6B3D64E324B4
SHA-512:	2180AA83284B9DBEA66660D1DC44FA2B32702BCB064A6D09366EDE4492175E21B9D6F3CD2BB6FCFE9462D68C4AA2189383195847C354AE8A086A1A9E2FD6D691
Malicious:	false
Preview:	LPKSHHRH..................W5..Bd.<9u...V..................................W5..Bd.<9u...V........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12393
Entropy (8bit):	4.909176197026153
Encrypted:	false
SSDEEP:	96:PaNOZqbKW+PmYv5ToqBSl3iLfSabrBtzFvemGMTlMVRp5nqboDwi/v9AHkUkbimq:N2aRYG9r8vnM02h4kHr1hpZfvrN
MD5:	42D75CFCE56C4F354C24617C14F484A6
SHA1:	D59452A062DFD0F1FD22B70B9D81F4F749523AE2
SHA-256:	F127CA118C7994CD678CB85458EA57363D88F62C25130E4315E2A8AFB83ADF5B
SHA-512:	8439937930EBE690EBF5D15A37B340DE53CFBDF691F7EB048B6C3BA8367B73C1988EFCB77FD6C9B8B20E0D7D1297CC11DB77E4E1FE318033BE406BCBE6A74351
Malicious:	false
Preview:	Dec 11 03:00:07 galassia kernel: [ 548.241059] blocking signal 9: 6252 -> 2048.Dec 11 03:00:07 galassia kernel: [ 552.635521] blocking signal 9: 6252 -> 658.Dec 11 03:00:07 galassia kernel: [ 552.640752] blocking signal 9: 6252 -> 720.Dec 11 03:00:07 galassia kernel: [ 552.643191] blocking signal 9: 6252 -> 772.Dec 11 03:00:07 galassia kernel: [ 552.650026] blocking signal 9: 6252 -> 936.Dec 11 03:00:07 galassia kernel: [ 552.653455] blocking signal 9: 6252 -> 2048.Dec 11 03:00:07 galassia kernel: [ 553.152676] New task spawned: old: (tgid 6962, tid 6962), new (tgid: 6962, tid: 7004).Dec 11 03:00:07 galassia kernel: [ 553.153677] New task spawned: old: (tgid 6962, tid 6962), new (tgid: 6962, tid: 7005).Dec 11 03:00:08 galassia kernel: [ 553.164473] New task spawned: old: (tgid 6962, tid 7005), new (tgid: 6962, tid: 7006).Dec 11 03:00:08 galassia kernel: [ 553.433674] New task spawned: old: (tgid 6975, tid 6975), new (tgid: 6975, tid: 7007).Dec 11 03:00:09 galassia kernel: [

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	30796
Entropy (8bit):	5.068352349649889
Encrypted:	false
SSDEEP:	768:pboMO6oMO7+KE0lBDJXzlV95v79NkAy+lKLuKYvbVP1ZHsOi8wC2UL5NPr:2+Elfn
MD5:	D820B681BB3FB539D1F9D0BDC56BE9B7
SHA1:	71BAAD39D9A1CB3EDA7F0D48D1518DD2B4F348A4
SHA-256:	93A0D9A13BAB6B4EF9AA46C8C53738DA299CF965D574D9B7415A477BA08368C5
SHA-512:	84FE9E4390A4BCCE797CAB79035A391074C2B0FC94BAAB4A1BDB6AEC42B9B9E336D44958ED25A3D542E4CE5BBEDE6A14B3819894E5177A176DB1E0175195B776
Malicious:	false
Preview:	Dec 11 03:00:07 galassia kernel: [ 548.241059] blocking signal 9: 6252 -> 2048.Dec 11 03:00:07 galassia kernel: [ 552.570820] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 11 03:00:07 galassia kernel: [ 552.570832] systemd[1]: Stopped Journal Service..Dec 11 03:00:07 galassia kernel: [ 552.572134] systemd[1]: Starting Journal Service....Dec 11 03:00:07 galassia kernel: [ 552.573253] systemd[1]: getty@tty2.service: Succeeded..Dec 11 03:00:07 galassia kernel: [ 552.574022] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 11 03:00:07 galassia kernel: [ 552.574103] systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 11 03:00:07 galassia kernel: [ 552.574658] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 11 03:00:07 galassia kernel: [ 552.574662] systemd[1]: dbus.service: Failed with result 'signal'..Dec 11 03:00:07 galassia kernel: [ 552.576455] systemd[1]: gett

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:5CsXlXEWtl/HlFX:5f+ylflFX
MD5:	955B4DCBF3A9D5F1544CDA9348DCD350
SHA1:	3FAA931D4DEA99A8D04F623C118736C24C57C602
SHA-256:	4AE2ABA1D8C89199D06B9A20ADA96C9DF673B8DC3803D22287414E3F15F5F698
SHA-512:	DCAC473358B9928CF1D6DF4FEE59FF48E428606C81B749EC5F4F5AF391739372AFB27FDFDEB2A4B8EF35333DF186195DB4F867D447859979FC933C67F4D0CB79
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................TYgUs......................................

Source: wheiuwa4.elf	ReversingLabs: Detection: 65%
Source: wheiuwa4.elf	Virustotal: Detection: 40%			Perma Link

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:52674 -> 178.215.238.4:33966

File type:	ELF 32-bit LSB executable, ARM, version 1 (ARM), statically linked, stripped
Entropy (8bit):	5.588777764718115
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wheiuwa4.elf
File size:	162'560 bytes
MD5:	3d9f94b86edde676d3241c1707c965cb
SHA1:	b7121399cf77d48c48b2a256b8df1f3579603239
SHA256:	05ce105f8c50cc8ad232fb7e55d253713a438b08c38735bfea18f04fda288924
SHA512:	021558a83495e651baca0e7874f78886b3dc3e3d20e505f7ec826effad8b21ebdb29a5343bbdb01170eefa32277fbeda801b29f8bf30d6812b4abeea652bc61b
SSDEEP:	1536:ec8n+sXCFKtDnofa+0uXivAppBCAsmo4Vp7gTCU33qW53O/ly0iVu2L5lmlwywrG:ec8nlDo/0FA7BCV4rgmU33zDnIWvTxs
TLSH:	0FF31941F8418F23C6D612BBFB5E428D372A17A8D3EE72039D256F21378695B0E37652
File Content Preview:	.ELF...a..........(.........4...py......4. ...(.....................t&..t&...............0...0...0..0I..............Q.td..................................-...L."...3}..........0@-.\P...0....S.0...P@...0... ....R......0...0...........0... ....R..... 0....S

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	ARM
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	ARM - ABI
ABI Version:	0
Entry Point Address:	0x8190
Flags:	0x202
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	162160
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8094	0x94	0x18	0x0	0x6	AX	4
.text	PROGBITS	0x80b0	0xb0	0x1f504	0x0	0x6	AX	16
.fini	PROGBITS	0x275b4	0x1f5b4	0x14	0x0	0x6	AX	4
.rodata	PROGBITS	0x275c8	0x1f5c8	0x30ac	0x0	0x2	A	4
.ctors	PROGBITS	0x33000	0x23000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x3300c	0x2300c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x33020	0x23020	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x37930	0x27930	0x45e4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x27930	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8000	0x8000	0x22674	0x22674	6.0689	0x5	R E	0x8000	.init .text .fini .rodata
LOAD	0x23000	0x33000	0x33000	0x4930	0x8f14	0.4244	0x6	RW	0x8000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 11, 2024 09:58:41.192167997 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 11, 2024 10:00:01.203725100 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 09:57:50.866522074 CET	192.168.2.23	8.8.8.8	0xd138	Standard query (0)	raw.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:57:51.233988047 CET	192.168.2.23	8.8.8.8	0x3c8e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 11, 2024 09:57:51.357544899 CET	192.168.2.23	8.8.8.8	0x3c8e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 11, 2024 09:57:51.482047081 CET	192.168.2.23	8.8.8.8	0x3c8e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 11, 2024 09:57:51.605762959 CET	192.168.2.23	8.8.8.8	0x3c8e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 11, 2024 09:57:51.777823925 CET	192.168.2.23	8.8.8.8	0x3c8e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	271	false
Dec 11, 2024 09:57:53.904654026 CET	192.168.2.23	8.8.8.8	0x7893	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 11, 2024 09:57:54.027936935 CET	192.168.2.23	8.8.8.8	0x7893	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	274	false
Dec 11, 2024 09:57:54.151259899 CET	192.168.2.23	8.8.8.8	0x7893	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	274	false
Dec 11, 2024 09:57:54.275949001 CET	192.168.2.23	8.8.8.8	0x7893	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	274	false
Dec 11, 2024 09:57:54.401360989 CET	192.168.2.23	8.8.8.8	0x7893	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	274	false
Dec 11, 2024 09:57:56.534421921 CET	192.168.2.23	8.8.8.8	0xa302	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 09:57:56.657721043 CET	192.168.2.23	8.8.8.8	0xa302	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 09:57:56.780894995 CET	192.168.2.23	8.8.8.8	0xa302	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 09:57:56.905767918 CET	192.168.2.23	8.8.8.8	0xa302	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 09:57:57.028819084 CET	192.168.2.23	8.8.8.8	0xa302	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	277	false
Dec 11, 2024 09:57:59.154551983 CET	192.168.2.23	8.8.8.8	0x4d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 11, 2024 09:57:59.277545929 CET	192.168.2.23	8.8.8.8	0x4d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 11, 2024 09:57:59.400393009 CET	192.168.2.23	8.8.8.8	0x4d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 11, 2024 09:57:59.523438931 CET	192.168.2.23	8.8.8.8	0x4d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 11, 2024 09:57:59.646756887 CET	192.168.2.23	8.8.8.8	0x4d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 11, 2024 09:58:01.770505905 CET	192.168.2.23	8.8.8.8	0x6394	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 11, 2024 09:58:01.894026041 CET	192.168.2.23	8.8.8.8	0x6394	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 11, 2024 09:58:02.017159939 CET	192.168.2.23	8.8.8.8	0x6394	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	282	false
Dec 11, 2024 09:58:02.140136957 CET	192.168.2.23	8.8.8.8	0x6394	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	282	false
Dec 11, 2024 09:58:02.263250113 CET	192.168.2.23	8.8.8.8	0x6394	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	282	false
Dec 11, 2024 09:58:04.386014938 CET	192.168.2.23	8.8.8.8	0x3f59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 09:58:04.508543968 CET	192.168.2.23	8.8.8.8	0x3f59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 09:58:04.631323099 CET	192.168.2.23	8.8.8.8	0x3f59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 09:58:04.754091024 CET	192.168.2.23	8.8.8.8	0x3f59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 09:58:04.877067089 CET	192.168.2.23	8.8.8.8	0x3f59	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 09:58:07.001848936 CET	192.168.2.23	8.8.8.8	0x62d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	287	false
Dec 11, 2024 09:58:07.124711990 CET	192.168.2.23	8.8.8.8	0x62d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	287	false
Dec 11, 2024 09:58:07.247570992 CET	192.168.2.23	8.8.8.8	0x62d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	287	false
Dec 11, 2024 09:58:07.370683908 CET	192.168.2.23	8.8.8.8	0x62d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	287	false
Dec 11, 2024 09:58:07.493658066 CET	192.168.2.23	8.8.8.8	0x62d7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	287	false
Dec 11, 2024 09:58:09.625658989 CET	192.168.2.23	8.8.8.8	0x20c9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 11, 2024 09:58:09.748409986 CET	192.168.2.23	8.8.8.8	0x20c9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 11, 2024 09:58:09.872262001 CET	192.168.2.23	8.8.8.8	0x20c9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	289	false
Dec 11, 2024 09:58:09.995038033 CET	192.168.2.23	8.8.8.8	0x20c9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	290	false
Dec 11, 2024 09:58:10.117769957 CET	192.168.2.23	8.8.8.8	0x20c9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	290	false
Dec 11, 2024 09:58:12.245424032 CET	192.168.2.23	8.8.8.8	0x80f8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 11, 2024 09:58:12.368657112 CET	192.168.2.23	8.8.8.8	0x80f8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 11, 2024 09:58:12.491906881 CET	192.168.2.23	8.8.8.8	0x80f8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 11, 2024 09:58:12.615199089 CET	192.168.2.23	8.8.8.8	0x80f8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 11, 2024 09:58:12.738743067 CET	192.168.2.23	8.8.8.8	0x80f8	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	292	false
Dec 11, 2024 09:58:14.867990017 CET	192.168.2.23	8.8.8.8	0x6a88	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	294	false
Dec 11, 2024 09:58:14.993648052 CET	192.168.2.23	8.8.8.8	0x6a88	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	294	false
Dec 11, 2024 09:58:15.117439032 CET	192.168.2.23	8.8.8.8	0x6a88	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	295	false
Dec 11, 2024 09:58:15.241152048 CET	192.168.2.23	8.8.8.8	0x6a88	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	295	false
Dec 11, 2024 09:58:15.366930962 CET	192.168.2.23	8.8.8.8	0x6a88	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	295	false
Dec 11, 2024 09:58:17.492655993 CET	192.168.2.23	8.8.8.8	0x4ea0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 11, 2024 09:58:17.615576982 CET	192.168.2.23	8.8.8.8	0x4ea0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 11, 2024 09:58:17.738739014 CET	192.168.2.23	8.8.8.8	0x4ea0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 11, 2024 09:58:17.861727953 CET	192.168.2.23	8.8.8.8	0x4ea0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	297	false
Dec 11, 2024 09:58:17.984659910 CET	192.168.2.23	8.8.8.8	0x4ea0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	298	false
Dec 11, 2024 09:58:20.113631964 CET	192.168.2.23	8.8.8.8	0x9fe9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	300	false
Dec 11, 2024 09:58:20.237013102 CET	192.168.2.23	8.8.8.8	0x9fe9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	300	false
Dec 11, 2024 09:58:20.360424995 CET	192.168.2.23	8.8.8.8	0x9fe9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	300	false
Dec 11, 2024 09:58:20.483551025 CET	192.168.2.23	8.8.8.8	0x9fe9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	300	false
Dec 11, 2024 09:58:20.607036114 CET	192.168.2.23	8.8.8.8	0x9fe9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	300	false
Dec 11, 2024 09:58:22.736010075 CET	192.168.2.23	8.8.8.8	0x3a49	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	302	false
Dec 11, 2024 09:58:22.859610081 CET	192.168.2.23	8.8.8.8	0x3a49	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	302	false
Dec 11, 2024 09:58:22.982400894 CET	192.168.2.23	8.8.8.8	0x3a49	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	303	false
Dec 11, 2024 09:58:23.105345964 CET	192.168.2.23	8.8.8.8	0x3a49	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	303	false
Dec 11, 2024 09:58:23.228183031 CET	192.168.2.23	8.8.8.8	0x3a49	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	303	false
Dec 11, 2024 09:58:25.350750923 CET	192.168.2.23	8.8.8.8	0x9cd5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 11, 2024 09:58:25.473851919 CET	192.168.2.23	8.8.8.8	0x9cd5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 11, 2024 09:58:25.597455978 CET	192.168.2.23	8.8.8.8	0x9cd5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 11, 2024 09:58:25.720545053 CET	192.168.2.23	8.8.8.8	0x9cd5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 11, 2024 09:58:25.934899092 CET	192.168.2.23	8.8.8.8	0x9cd5	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	305	false
Dec 11, 2024 09:58:28.063698053 CET	192.168.2.23	8.8.8.8	0xbe06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	308	false
Dec 11, 2024 09:58:28.186690092 CET	192.168.2.23	8.8.8.8	0xbe06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	308	false
Dec 11, 2024 09:58:28.309683084 CET	192.168.2.23	8.8.8.8	0xbe06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	308	false
Dec 11, 2024 09:58:28.432863951 CET	192.168.2.23	8.8.8.8	0xbe06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	308	false
Dec 11, 2024 09:58:28.556658983 CET	192.168.2.23	8.8.8.8	0xbe06	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	308	false
Dec 11, 2024 09:58:30.683813095 CET	192.168.2.23	8.8.8.8	0xb5ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	310	false
Dec 11, 2024 09:58:30.807229996 CET	192.168.2.23	8.8.8.8	0xb5ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	310	false
Dec 11, 2024 09:58:30.930149078 CET	192.168.2.23	8.8.8.8	0xb5ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	310	false
Dec 11, 2024 09:58:31.053050995 CET	192.168.2.23	8.8.8.8	0xb5ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	311	false
Dec 11, 2024 09:58:31.175904989 CET	192.168.2.23	8.8.8.8	0xb5ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	311	false
Dec 11, 2024 09:58:33.310908079 CET	192.168.2.23	8.8.8.8	0xa6f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	313	false
Dec 11, 2024 09:58:33.434847116 CET	192.168.2.23	8.8.8.8	0xa6f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	313	false
Dec 11, 2024 09:58:33.558589935 CET	192.168.2.23	8.8.8.8	0xa6f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	313	false
Dec 11, 2024 09:58:33.682557106 CET	192.168.2.23	8.8.8.8	0xa6f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	313	false
Dec 11, 2024 09:58:33.872234106 CET	192.168.2.23	8.8.8.8	0xa6f9	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	313	false
Dec 11, 2024 09:58:38.553220987 CET	192.168.2.23	1.1.1.1	0x3152	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:58:38.553220987 CET	192.168.2.23	1.1.1.1	0xdc98	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 09:58:39.152553082 CET	192.168.2.23	1.1.1.1	0xe3e2	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 09:58:56.542290926 CET	192.168.2.23	8.8.8.8	0xe2ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 11, 2024 09:58:56.667160988 CET	192.168.2.23	8.8.8.8	0xe2ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 11, 2024 09:58:56.791610956 CET	192.168.2.23	8.8.8.8	0xe2ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 11, 2024 09:58:56.916269064 CET	192.168.2.23	8.8.8.8	0xe2ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	336	false
Dec 11, 2024 09:58:57.040198088 CET	192.168.2.23	8.8.8.8	0xe2ab	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	337	false
Dec 11, 2024 09:59:00.875859022 CET	192.168.2.23	1.1.1.1	0x9076	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 09:59:16.025192976 CET	192.168.2.23	1.1.1.1	0xb14	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 10:00:10.837174892 CET	192.168.2.23	1.1.1.1	0x9e36	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 10:00:10.837214947 CET	192.168.2.23	1.1.1.1	0x8763	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 10:00:56.585602999 CET	192.168.2.23	8.8.8.8	0xf459	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Dec 11, 2024 10:00:56.709724903 CET	192.168.2.23	8.8.8.8	0xf459	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Dec 11, 2024 10:00:56.832591057 CET	192.168.2.23	8.8.8.8	0xf459	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	456	false
Dec 11, 2024 10:00:56.955408096 CET	192.168.2.23	8.8.8.8	0xf459	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	457	false
Dec 11, 2024 10:00:57.078387976 CET	192.168.2.23	8.8.8.8	0xf459	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	457	false
Dec 11, 2024 10:00:59.202363968 CET	192.168.2.23	8.8.8.8	0xf983	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	459	false
Dec 11, 2024 10:00:59.325171947 CET	192.168.2.23	8.8.8.8	0xf983	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	459	false
Dec 11, 2024 10:00:59.447993994 CET	192.168.2.23	8.8.8.8	0xf983	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	459	false
Dec 11, 2024 10:00:59.573008060 CET	192.168.2.23	8.8.8.8	0xf983	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	459	false
Dec 11, 2024 10:00:59.695986032 CET	192.168.2.23	8.8.8.8	0xf983	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	459	false
Dec 11, 2024 10:01:01.819075108 CET	192.168.2.23	8.8.8.8	0xbe38	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	461	false
Dec 11, 2024 10:01:01.942287922 CET	192.168.2.23	8.8.8.8	0xbe38	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	462	false
Dec 11, 2024 10:01:02.065057039 CET	192.168.2.23	8.8.8.8	0xbe38	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	462	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 09:57:51.232223034 CET	8.8.8.8	192.168.2.23	0xd138	No error (0)	raw.cardiacpure.ru	178.215.238.4	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:58:38.778933048 CET	1.1.1.1	192.168.2.23	0x3152	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 11, 2024 09:58:38.778933048 CET	1.1.1.1	192.168.2.23	0x3152	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 11, 2024 10:00:11.061009884 CET	1.1.1.1	192.168.2.23	0x9e36	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 11, 2024 10:00:11.061009884 CET	1.1.1.1	192.168.2.23	0x9e36	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-11 08:58:43 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-11 08:58:43 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-11 08:58:43 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-11 08:58:44 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Dec 2024 08:58:44 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	08:57:48
Start date (UTC):	11/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	08:57:49
Start date (UTC):	11/12/2024
Path:	/tmp/wheiuwa4.elf
Arguments:	/tmp/wheiuwa4.elf
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	08:57:51
Start date (UTC):	11/12/2024
Path:	/tmp/wheiuwa4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	08:59:14
Start date (UTC):	11/12/2024
Path:	/tmp/wheiuwa4.elf
Arguments:	-
File size:	4956856 bytes
MD5 hash:	5ebfcae4fe2471fcc5695c2394773ff1

Start time (UTC):	08:57:50
Start date (UTC):	11/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	08:58:30
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:58:32
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:58:35
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:58:36
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:58:37
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wheiuwa4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6618/oom_score_adj

/proc/6920/oom_score_adj

/proc/7079/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:10495732vssuT

/run/systemd/journal/streams/.#9:2185296pKRjDS

/run/systemd/journal/streams/.#9:2378297vSLqDS

/run/systemd/journal/streams/.#9:2378303OaSPJR

/run/systemd/journal/streams/.#9:2378305ReUh6U

/run/systemd/journal/streams/.#9:2378481QrKcFU

/run/systemd/journal/streams/.#9:2378528LwOqET

/run/systemd/journal/streams/.#9:2378654oXRqjV

/run/systemd/journal/streams/.#9:2381955B1NEqU

/run/systemd/journal/streams/.#9:2382597ks1sgT

/run/systemd/journal/streams/.#9:643840WOa02U

/run/systemd/journal/streams/.#9:643841Sle0YS

/run/systemd/journal/streams/.#9:643842I9XHSV

/run/systemd/journal/streams/.#9:643856Qqn51T

/run/systemd/journal/streams/.#9:643859qGrggV

/run/systemd/journal/streams/.#9:643868gIDuAS

/run/systemd/journal/streams/.#9:643875R7VbsT

Linux Analysis Report
wheiuwa4.elf

Start time (UTC):	08:58:38
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	08:58:39
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	08:58:40
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	08:58:43
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:58:41
Start date (UTC):	11/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Start time (UTC):	08:58:42
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:58:53
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	08:58:54
Start date (UTC):	11/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	08:58:56
Start date (UTC):	11/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	08:58:57
Start date (UTC):	11/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4