Edit tour

Linux Analysis Report
dwhdbg.elf

Overview

General Information

Sample name:	dwhdbg.elf
Analysis ID:	1573369
MD5:	e90fe2a6dd20cd7cca1f438595fe3906
SHA1:	5775adb8b1cc52ba68c78a2bbf71e5df0eac0329
SHA256:	e269623e4ffc0248a8d272b2b7956d60d291739a6d0c351587a7952f4c6cea15
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	92
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573369
Start date and time:	2024-12-11 21:56:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	dwhdbg.elf
Detection:	MAL
Classification:	mal92.spre.troj.evad.linELF@0/159@59/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: dwhdbg.elf

Process Tree

system is lnxubuntu20

dwhdbg.elf (PID: 6240, Parent: 6164, MD5: e90fe2a6dd20cd7cca1f438595fe3906) Arguments: /tmp/dwhdbg.elf

dwhdbg.elf New Fork (PID: 6241, Parent: 6240)

dwhdbg.elf New Fork (PID: 6397, Parent: 6241)

sh (PID: 6397, Parent: 6241, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6398, Parent: 6397)

ps (PID: 6398, Parent: 6397, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

dwhdbg.elf New Fork (PID: 6830, Parent: 6241)

sh (PID: 6830, Parent: 6241, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6832, Parent: 6830)

ps (PID: 6832, Parent: 6830, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6242, Parent: 1477)

sh (PID: 6242, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6242, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6247, Parent: 1)

systemd-hostnamed (PID: 6247, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6367, Parent: 1320)

Default (PID: 6367, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6385, Parent: 1320)

Default (PID: 6385, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6460, Parent: 1)

journalctl (PID: 6460, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6479, Parent: 1)

systemd-journald (PID: 6479, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6480, Parent: 1)

journalctl (PID: 6480, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6496, Parent: 1)

dbus-daemon (PID: 6496, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6500, Parent: 1860)

pulseaudio (PID: 6500, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6502, Parent: 1)

rsyslogd (PID: 6502, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6509, Parent: 1)

systemd-logind (PID: 6509, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6568, Parent: 1)

rtkit-daemon (PID: 6568, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6572, Parent: 1)

polkitd (PID: 6572, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6576, Parent: 1)

agetty (PID: 6576, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6577, Parent: 1320)

Default (PID: 6577, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6581, Parent: 1)

gpu-manager (PID: 6581, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6582, Parent: 6581)

sh (PID: 6582, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6583, Parent: 6582)

grep (PID: 6583, Parent: 6582, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6584, Parent: 6581)

sh (PID: 6584, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6585, Parent: 6584)

grep (PID: 6585, Parent: 6584, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6586, Parent: 6581)

sh (PID: 6586, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6587, Parent: 6586)

grep (PID: 6587, Parent: 6586, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6588, Parent: 6581)

sh (PID: 6588, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6590, Parent: 6581)

sh (PID: 6590, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6591, Parent: 6590)

grep (PID: 6591, Parent: 6590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6592, Parent: 6581)

sh (PID: 6592, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6593, Parent: 6592)

grep (PID: 6593, Parent: 6592, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6595, Parent: 6581)

sh (PID: 6595, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

grep (PID: 6596, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6601, Parent: 6581)

sh (PID: 6601, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6602, Parent: 6601)

grep (PID: 6602, Parent: 6601, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gvfsd-fuse New Fork (PID: 6594, Parent: 2038)

fusermount (PID: 6594, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6606, Parent: 1)

generate-config (PID: 6606, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6607, Parent: 6606)

pkill (PID: 6607, Parent: 6606, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6608, Parent: 1)

gdm-wait-for-drm (PID: 6608, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6614, Parent: 1)

gdm3 (PID: 6614, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6617, Parent: 6614)

plymouth (PID: 6617, Parent: 6614, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6627, Parent: 6614)

gdm-session-worker (PID: 6627, Parent: 6614, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6633, Parent: 6627)

gdm-wayland-session (PID: 6633, Parent: 6627, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6635, Parent: 6633)

dbus-daemon (PID: 6635, Parent: 6633, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6637, Parent: 6635)

dbus-daemon New Fork (PID: 6638, Parent: 6637)

false (PID: 6638, Parent: 6637, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6639, Parent: 6633)

dbus-run-session (PID: 6639, Parent: 6633, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6640, Parent: 6639)

gdm3 New Fork (PID: 6642, Parent: 6614)

Default (PID: 6642, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6643, Parent: 6614)

Default (PID: 6643, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6618, Parent: 1)

accounts-daemon (PID: 6618, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6622, Parent: 6618)

language-validate (PID: 6622, Parent: 6618, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6623, Parent: 6622)

language-options (PID: 6623, Parent: 6622, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6624, Parent: 6623)

sh (PID: 6624, Parent: 6623, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6625, Parent: 6624)

locale (PID: 6625, Parent: 6624, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6626, Parent: 6624)

grep (PID: 6626, Parent: 6624, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6645, Parent: 1)

dbus-daemon (PID: 6645, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6646, Parent: 1)

rsyslogd (PID: 6646, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6647, Parent: 1)

agetty (PID: 6647, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6651, Parent: 1)

gpu-manager (PID: 6651, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6712, Parent: 6651)

sh (PID: 6712, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6713, Parent: 6712)

grep (PID: 6713, Parent: 6712, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6715, Parent: 6651)

sh (PID: 6715, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6716, Parent: 6715)

grep (PID: 6716, Parent: 6715, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6717, Parent: 6651)

sh (PID: 6717, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6718, Parent: 6717)

grep (PID: 6718, Parent: 6717, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6719, Parent: 6651)

sh (PID: 6719, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6720, Parent: 6719)

grep (PID: 6720, Parent: 6719, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6721, Parent: 6651)

sh (PID: 6721, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6724, Parent: 6721)

grep (PID: 6724, Parent: 6721, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6725, Parent: 6651)

sh (PID: 6725, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6726, Parent: 6725)

grep (PID: 6726, Parent: 6725, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6727, Parent: 6651)

sh (PID: 6727, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6728, Parent: 6727)

grep (PID: 6728, Parent: 6727, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6729, Parent: 6651)

sh (PID: 6729, Parent: 6651, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6730, Parent: 6729)

grep (PID: 6730, Parent: 6729, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6654, Parent: 1)

systemd-logind (PID: 6654, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6731, Parent: 1)

generate-config (PID: 6731, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6732, Parent: 6731)

pkill (PID: 6732, Parent: 6731, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6733, Parent: 1)

gdm-wait-for-drm (PID: 6733, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6738, Parent: 1)

dbus-daemon (PID: 6738, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6742, Parent: 1)

rsyslogd (PID: 6742, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6746, Parent: 1)

journalctl (PID: 6746, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6747, Parent: 1)

systemd-journald (PID: 6747, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6750, Parent: 1)

systemd-logind (PID: 6750, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6808, Parent: 1)

dbus-daemon (PID: 6808, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6809, Parent: 1)

agetty (PID: 6809, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6810, Parent: 1)

rsyslogd (PID: 6810, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6811, Parent: 1)

gpu-manager (PID: 6811, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6815, Parent: 6811)

sh (PID: 6815, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6816, Parent: 6815)

grep (PID: 6816, Parent: 6815, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6820, Parent: 6811)

sh (PID: 6820, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6821, Parent: 6820)

grep (PID: 6821, Parent: 6820, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6822, Parent: 6811)

sh (PID: 6822, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6823, Parent: 6822)

grep (PID: 6823, Parent: 6822, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6825, Parent: 6811)

sh (PID: 6825, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6827, Parent: 6825)

grep (PID: 6827, Parent: 6825, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6828, Parent: 6811)

sh (PID: 6828, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6829, Parent: 6828)

grep (PID: 6829, Parent: 6828, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6831, Parent: 6811)

sh (PID: 6831, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6833, Parent: 6831)

grep (PID: 6833, Parent: 6831, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6834, Parent: 6811)

sh (PID: 6834, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6835, Parent: 6834)

grep (PID: 6835, Parent: 6834, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6836, Parent: 6811)

sh (PID: 6836, Parent: 6811, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6837, Parent: 6836)

grep (PID: 6837, Parent: 6836, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6840, Parent: 1)

generate-config (PID: 6840, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6841, Parent: 6840)

pkill (PID: 6841, Parent: 6840, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6842, Parent: 1)

journalctl (PID: 6842, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6844, Parent: 1)

gdm-wait-for-drm (PID: 6844, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6849, Parent: 1)

gdm3 (PID: 6849, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6852, Parent: 6849)

plymouth (PID: 6852, Parent: 6849, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6868, Parent: 6849)

gdm-session-worker (PID: 6868, Parent: 6849, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6872, Parent: 6868)

gdm-wayland-session (PID: 6872, Parent: 6868, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6874, Parent: 6872)

dbus-daemon (PID: 6874, Parent: 6872, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6876, Parent: 6874)

dbus-daemon New Fork (PID: 6877, Parent: 6876)

false (PID: 6877, Parent: 6876, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6878, Parent: 6872)

dbus-run-session (PID: 6878, Parent: 6872, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6879, Parent: 6878)

dbus-daemon (PID: 6879, Parent: 6878, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6882, Parent: 6849)

Default (PID: 6882, Parent: 6849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6883, Parent: 6849)

Default (PID: 6883, Parent: 6849, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6853, Parent: 1)

accounts-daemon (PID: 6853, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6857, Parent: 6853)

language-validate (PID: 6857, Parent: 6853, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6860, Parent: 6857)

language-options (PID: 6860, Parent: 6857, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6861, Parent: 6860)

sh (PID: 6861, Parent: 6860, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6862, Parent: 6861)

locale (PID: 6862, Parent: 6861, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6863, Parent: 6861)

grep (PID: 6863, Parent: 6861, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6864, Parent: 1)

polkitd (PID: 6864, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6895, Parent: 1860)

dbus-daemon (PID: 6895, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6896, Parent: 1860)

pulseaudio (PID: 6896, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6897, Parent: 1)

rtkit-daemon (PID: 6897, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6906, Parent: 1)

journalctl (PID: 6906, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6909, Parent: 1)

dbus-daemon (PID: 6909, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6910, Parent: 1)

systemd-logind (PID: 6910, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6925, Parent: 1)

agetty (PID: 6925, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6969, Parent: 1)

systemd-journald (PID: 6969, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6970, Parent: 1)

rsyslogd (PID: 6970, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6971, Parent: 1)

dbus-daemon (PID: 6971, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6972, Parent: 1860)

pulseaudio (PID: 6972, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6974, Parent: 1)

gpu-manager (PID: 6974, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6978, Parent: 6974)

sh (PID: 6978, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6979, Parent: 6978)

grep (PID: 6979, Parent: 6978, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6981, Parent: 6974)

sh (PID: 6981, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6982, Parent: 6981)

grep (PID: 6982, Parent: 6981, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6985, Parent: 6974)

sh (PID: 6985, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6986, Parent: 6985)

grep (PID: 6986, Parent: 6985, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6990, Parent: 6974)

sh (PID: 6990, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6991, Parent: 6990)

grep (PID: 6991, Parent: 6990, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6996, Parent: 6974)

sh (PID: 6996, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6999, Parent: 6996)

grep (PID: 6999, Parent: 6996, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7001, Parent: 6974)

sh (PID: 7001, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7002, Parent: 7001)

grep (PID: 7002, Parent: 7001, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7003, Parent: 6974)

sh (PID: 7003, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7004, Parent: 7003)

grep (PID: 7004, Parent: 7003, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7005, Parent: 6974)

sh (PID: 7005, Parent: 6974, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7006, Parent: 7005)

grep (PID: 7006, Parent: 7005, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6988, Parent: 1)

rtkit-daemon (PID: 6988, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6994, Parent: 1)

polkitd (PID: 6994, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7010, Parent: 1)

generate-config (PID: 7010, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7011, Parent: 7010)

pkill (PID: 7011, Parent: 7010, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7013, Parent: 1860)

dbus-daemon (PID: 7013, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7016, Parent: 1)

journalctl (PID: 7016, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7019, Parent: 1)

gdm-wait-for-drm (PID: 7019, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7024, Parent: 1)

gdm3 (PID: 7024, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7027, Parent: 7024)

plymouth (PID: 7027, Parent: 7024, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7037, Parent: 7024)

gdm-session-worker (PID: 7037, Parent: 7024, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7045, Parent: 7037)

gdm-wayland-session (PID: 7045, Parent: 7037, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7047, Parent: 7045)

dbus-daemon (PID: 7047, Parent: 7045, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7051, Parent: 7047)

dbus-daemon New Fork (PID: 7052, Parent: 7051)

false (PID: 7052, Parent: 7051, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7053, Parent: 7045)

dbus-run-session (PID: 7053, Parent: 7045, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7054, Parent: 7053)

dbus-daemon (PID: 7054, Parent: 7053, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7058, Parent: 7024)

Default (PID: 7058, Parent: 7024, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7059, Parent: 7024)

Default (PID: 7059, Parent: 7024, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7028, Parent: 1)

accounts-daemon (PID: 7028, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7032, Parent: 7028)

language-validate (PID: 7032, Parent: 7028, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7033, Parent: 7032)

language-options (PID: 7033, Parent: 7032, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7034, Parent: 7033)

sh (PID: 7034, Parent: 7033, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7035, Parent: 7034)

locale (PID: 7035, Parent: 7034, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7036, Parent: 7034)

grep (PID: 7036, Parent: 7034, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7043, Parent: 1)

systemd (PID: 7043, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7048, Parent: 7043)

systemd New Fork (PID: 7049, Parent: 7048)

30-systemd-environment-d-generator (PID: 7049, Parent: 7048, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7060, Parent: 7043)

systemctl (PID: 7060, Parent: 7043, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7061, Parent: 7043)

pulseaudio (PID: 7061, Parent: 7043, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7066, Parent: 7043)

dbus-daemon (PID: 7066, Parent: 7043, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
dwhdbg.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
dwhdbg.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
dwhdbg.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x129dc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
dwhdbg.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x13253:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
dwhdbg.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xedf6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xefe8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
dwhdbg.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x16fba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
dwhdbg.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1bc16:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
dwhdbg.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12e13:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
dwhdbg.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11d12:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
dwhdbg.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x130de:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
dwhdbg.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x11f0b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
dwhdbg.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
dwhdbg.elf	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1e45e:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
dwhdbg.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
dwhdbg.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6fd2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 10 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6240.1.0000000000400000.0000000000421000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1cb08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb44:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb58:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb6c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb80:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cb94:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cba8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbbc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbd0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbe4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cbf8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc0c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc20:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc34:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc48:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc5c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc70:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc84:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1cc98:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x129dc:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x13253:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xedf6:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xefe8:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x16fba:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1bc16:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x12e13:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x11d12:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x130de:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x11f0b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_449937aa	unknown	unknown	0x1e45e:$a: 00 00 5B 72 65 73 6F 6C 76 5D 20 46 6F 75 6E 64 20 49 50 20
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6240.1.0000000000400000.0000000000421000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x6fd2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: dwhdbg.elf PID: 6240	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: dwhdbg.elf PID: 6240	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x141e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1432:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1446:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x145a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x146e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1482:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1496:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x14fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x150e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1522:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1536:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x154a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x155e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1572:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1586:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x159a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x15ae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 12 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6502)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6742)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6810)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6970)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6479)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6614)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6635)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6747)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6849)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6874)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6969)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7024)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7047)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7054)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7043)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.194.dr, syslog.182.dr, syslog.295.dr, syslog.131.dr, syslog.40.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53870
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: dwhdbg.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4480, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4483, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4509, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6064, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6075, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6187, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6373, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6374, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6375, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6376, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6377, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6378, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6496, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6641, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6645, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6647, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6479, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6738, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2014, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2038, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2180, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2208, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2289, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2302, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6432, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6452, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6500, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6807, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6808, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6809, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6810, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6830, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6832, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6849, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6895, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6906, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6909, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6953, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6242, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2009, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2128, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2281, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2285, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2307, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4480, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4483, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 4509, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6064, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6075, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6187, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6195, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6224, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6256, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6259, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6373, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6374, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6375, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6376, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6377, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6378, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6496, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6499, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6502, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6576, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6641, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6645, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6646, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6647, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6479, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6654, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6736, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6738, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6742, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 1886, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2014, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2038, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2180, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2208, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2289, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2302, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6432, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6452, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6497, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6498, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6500, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6750, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6807, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6808, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6809, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6810, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6830, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6832, result: no such process	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6849, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6895, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6896, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6906, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6909, result: successful	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6241)	SIGKILL sent: pid: 6953, result: successful	Jump to behavior

Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: dwhdbg.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_449937aa reference_sample = 6f27766534445cffb097c7c52db1fca53b2210c1b10b75594f77c34dc8b994fe, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = cf2c6b86830099f039b41aeaafbffedfb8294a1124c499e99a11f48a06cd1dfd, id = 449937aa-682a-4906-89ab-80d7127e461e, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: dwhdbg.elf PID: 6240, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal92.spre.troj.evad.linELF@0/159@59/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6496)	File: /proc/6496/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6594)	File: /proc/6594/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6635)	File: /proc/6635/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6645)	File: /proc/6645/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6738)	File: /proc/6738/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6808)	File: /proc/6808/mounts
Source: /usr/bin/dbus-daemon (PID: 6874)	File: /proc/6874/mounts
Source: /usr/bin/dbus-daemon (PID: 6895)	File: /proc/6895/mounts
Source: /usr/bin/dbus-daemon (PID: 6971)	File: /proc/6971/mounts
Source: /usr/bin/dbus-daemon (PID: 7013)	File: /proc/7013/mounts
Source: /usr/bin/dbus-daemon (PID: 7047)	File: /proc/7047/mounts
Source: /usr/bin/dbus-daemon (PID: 7054)	File: /proc/7054/mounts
Source: /usr/bin/dbus-daemon (PID: 7066)	File: /proc/7066/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6242)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6247)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76863loEx98	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76864lDNlR7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76084vs6E35	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76089ZHSzo7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76095rPjCL6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76288O2FSi7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76289ZixGc9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76407OAf9g6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76469XHqL97	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76517Cg3ri5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76663FTxe25	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:76667N0Lb77	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78873jRK1H5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78967QxCII8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79038zVKVG8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79040qVicA5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79096RVTV07	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79098IR1sh8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79170v7TVY7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79234xEgNb8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79259YS12R7	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79370vZdPD8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79485GNXWB5	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:79571Wpbgh9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78327Nwc4p6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	File: /run/systemd/journal/streams/.#9:78337HiS0F6	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/seats/.#seat02fKzTo	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/users/.#127zQ15ln	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/users/.#1270U4dWm	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/seats/.#seat0fkjI1l	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/users/.#127edhL2n	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6509)	File: /run/systemd/users/.#127gRdE6n	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6572)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6633)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6654)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6654)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6654)	File: /run/systemd/seats/.#seat00il8rn	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78742RH5ckn
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78743dSlzvp
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78744S1LdHo
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78752Zh83Kn
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78770UniyBn
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78773BDp8Tl
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78774L4Dtul
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:78783QBpwil
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:80910jTfvuo
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:80693XqutHm
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:80789ieuNsn
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:80834vjgo9k
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:80836HEkQep
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:80878fwqUQo
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:80880uzSBjm
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:82186D6EJan
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:82195TWP8Ll
Source: /lib/systemd/systemd-journald (PID: 6747)	File: /run/systemd/journal/streams/.#9:82314wknfHp
Source: /lib/systemd/systemd-logind (PID: 6750)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6750)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6750)	File: /run/systemd/seats/.#seat03DeOMD
Source: /lib/systemd/systemd-logind (PID: 6750)	File: /run/systemd/users/.#1272SjzpC
Source: /lib/systemd/systemd-logind (PID: 6750)	File: /run/systemd/users/.#127FK3kEz
Source: /lib/systemd/systemd-logind (PID: 6750)	File: /run/systemd/seats/.#seat0uBGd1C
Source: /lib/systemd/systemd-logind (PID: 6750)	File: /run/systemd/users/.#127DbDyND
Source: /lib/systemd/systemd-logind (PID: 6750)	File: /run/systemd/users/.#127zrqppD
Source: /lib/systemd/systemd-logind (PID: 6750)	File: /run/systemd/users/.#127BDBJHA
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6872)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6853)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6853)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6864)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6910)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6910)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/seats/.#seat09z28VI
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/users/.#127eXcqHI
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/users/.#1273KBsyG
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/seats/.#seat0pI63ZI
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/users/.#1270WCZgI
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/users/.#127W8s75F
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/users/.#127SCfvhF
Source: /lib/systemd/systemd-logind (PID: 6910)	File: /run/systemd/users/.#127pyVvZG
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:150969670wnz9
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509697KoWrW8
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509791auV7Ca
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509792xlwoNb
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509794ElN0nb
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509795VaGRfb
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509801EM4Pq9
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509815QAlEkc
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:15098169cgTac
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509822vPURPb
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:15098238GE0z9
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:150982475lAA9
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509825YavqT7
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:15098265uOEFb
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1509934gFIVEa
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1510041MQUITa
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1510104cuXc57
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:1510106lNEhrb
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:6398780jPjgtb
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:6398786CuPN8b
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:6398788slqT4a
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:63989687wEjN8
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:8198183QyHLGa
Source: /lib/systemd/systemd-journald (PID: 6969)	File: /run/systemd/journal/streams/.#9:9170410JcXdkb
Source: /usr/lib/policykit-1/polkitd (PID: 6994)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7045)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7028)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7028)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7043)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7049)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7066/stat
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7066/comm
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7066/cgroup
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7043/status
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7043/status
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7043/status
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7043/status
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7043/status
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7043/status
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7043/status
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7048/comm
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7060/comm
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7060/cgroup
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7061/stat
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7061/cgroup
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/7061/cgroup
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/1/environ
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/1/sched
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7043)	File opened: /proc/1/comm
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6496/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6496/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6572/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6500/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6500/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6500/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6499/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6499/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6509/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6568/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6633/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6614/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6627/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6627/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6496)	File opened: /proc/6618/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7043/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7024/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7045/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6971/status
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6971/attr/current
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7037/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7037/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6973/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6973/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7028/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6972/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6972/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6972/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6994/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7061/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/7061/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6988/cmdline
Source: /usr/bin/dbus-daemon (PID: 6971)	File opened: /proc/6910/cmdline
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/3088/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/230/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/110/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/231/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/111/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/232/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/112/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/233/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1699/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/113/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/234/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1335/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/114/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/235/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1334/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/2302/stat	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/ps (PID: 6398)	File opened: /proc/2302/cmdline	Jump to behavior

Source: /tmp/dwhdbg.elf (PID: 6397)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/dwhdbg.elf (PID: 6830)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6582)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6584)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6586)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6590)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6592)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6601)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6624)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6712)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6715)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6717)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6719)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6721)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6725)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6727)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6729)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6815)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6820)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6822)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6825)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6828)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6831)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6834)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6836)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6861)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6978)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6981)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6985)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6990)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6996)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7001)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7003)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7005)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7034)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6583)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6585)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6587)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6591)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6593)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6602)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6626)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6713)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6716)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6718)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6720)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6724)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6726)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6728)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6730)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6816)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6821)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6823)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6827)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6829)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6833)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6835)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6837)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6863)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6979)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6982)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6986)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6991)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6999)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7002)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7004)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7006)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7036)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6607)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6732)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6841)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7011)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6398)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6832)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7060)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6398)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6832)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6747)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6969)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6576)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6647)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6809)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6925)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6614)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6614)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6849)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6849)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6853)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6853)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7024)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7024)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7028)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7028)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6502)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6502)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6581)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6646)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6646)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6651)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6742)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6810)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6810)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6811)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6970)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6970)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6974)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/dwhdbg.elf (PID: 6240)

File: /tmp/dwhdbg.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6581)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6651)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6811)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6974)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6398)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6832)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6500)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6607)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6732)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6841)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6896)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6972)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7011)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7061)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6247)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6479)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6500)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6502)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6576)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6581)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6627)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6646)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6647)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6651)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6742)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6747)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6809)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6810)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6811)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6868)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6896)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6925)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6969)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6970)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6972)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6974)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7037)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7061)	Queries kernel information via 'uname':

Source: syslog.40.dr	Binary or memory string: Dec 11 14:58:10 galassia kernel: [ 491.138165] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.40.dr	Binary or memory string: Dec 11 14:58:10 galassia kernel: [ 491.138183] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: syslog.295.dr	Binary or memory string: Dec 11 15:00:05 galassia kernel: [ 606.297814] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.295.dr	Binary or memory string: Dec 11 15:00:05 galassia kernel: [ 606.297833] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6618)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6853)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7028)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: dwhdbg.elf, type: SAMPLE
Source: Yara match	File source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwhdbg.elf PID: 6240, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: dwhdbg.elf, type: SAMPLE
Source: Yara match	File source: 6240.1.0000000000400000.0000000000421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwhdbg.elf PID: 6240, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
dwhdbg.elf	100%	Avira	EXP/ELF.Mirai.Z.A
dwhdbg.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
raw.cardiacpure.ru	178.215.238.4	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.194.dr, syslog.182.dr, syslog.295.dr, syslog.131.dr, syslog.40.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse
	tgCdafZIfZ.elf	Get hash	malicious	Mirai	Browse
	LiUgL2AoGI.elf	Get hash	malicious	Mirai	Browse
	16RIueF7yh.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	qkehusl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	kjsusa6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	atlas.sparc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	la.bot.powerpc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
raw.cardiacpure.ru	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	iwir64.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vsbeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	tgCdafZIfZ.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	LiUgL2AoGI.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	16RIueF7yh.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	dvwkja7.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	atlas.sparc.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
	Josho.m68k.elf	Get hash	malicious	Unknown	Browse	200.1.79.131
	file.exe	Get hash	malicious	Amadey, LummaC Stealer, Stealc	Browse	94.154.172.218
	wnbw86.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
INIT7CH	arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	qkehusl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
CANONICAL-ASGB	arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_x86_64.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	qkehusl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6638/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/6877/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7052/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mXJn:mZ
MD5:	9D780882BF4C6E7D7989074C12CDD5B1
SHA1:	5D5D849BF2246BC18DAB967A678C7A3AE8F41835
SHA-256:	0C89A9FEE97533D42FB69EE7B06E4EEB7BFEBF30F362CD127E2A30C801CC775E
SHA-512:	8DE56CBFBBAE2F5D7A088561F0D861AB6B78EA92374856E7963138AD8BD77154523DCCEA0258DC74CBD37B11B61CE4E6669F20A7D546224DEE5151FF8890ED6E
Malicious:	false
Preview:	7024.

/run/systemd/journal/streams/.#9:150969670wnz9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.512809317248448
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8m8tgPem5WUBgZjsv:SbFuFyLVIg1BG+f+M8m8ttm5WUWji4s
MD5:	112F0B97A0F0409F21B7454104DC4239
SHA1:	8DC4654C94ACF47349A71CFB54FBDDE52A870D34
SHA-256:	83477A78AF2500B1D3F176E984847E2498FD0612B5EB94F73B4C0F5D5C586FD9
SHA-512:	8009B60649644F9EC8FC64BDAE7E79355A251E1D7C063D093CBCD2F187BFD4988C1EC9FF4EAB40F127898E143CF53526927FFC6DA85263CEC6E051E750652975
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=67003aa4c3f64f71b903df14a5811dbf.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:1509697KoWrW8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.381083739307775
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9b7XT3wtUUwkQwYu2:SbFuFyLVIg1BG+f+MhXTkXpYTjosQu
MD5:	B3D66559826808C1FB6FAD1499889A0C
SHA1:	DF259873A6DFDFB9189C9AA7D2B5DC4857121BC3
SHA-256:	8F6B686B3BF0A14C4F1EBF30C73428778DC1A361FF8D991D444EC9535F2F5E98
SHA-512:	FC7C231A8003CA909473CB4884EA3C3ADC8CAB860931EC5844BAF811434032849E26F96A0DE472FAF7C0B9CFE018493F67379E459F1EE7AC306458111D016775
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=76200e10ce644dc0b15f6a7a0ba69de2.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:1509791auV7Ca

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.492917497289871
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6MXYr0a2jZcHcljX+:qgFq6g10+f+M20aYmAu
MD5:	83EDEF84B76367764A1E77D7A53A6592
SHA1:	CAAEFF89C60845756503D9991E7AD84D8A844E48
SHA-256:	1E5E0A884AD4D4808D676B103516C1908D7D59DE80E70D0C1F8CC5EA0F89306A
SHA-512:	E9DFF66E4951F5503DDE771B5D60B0FA296B437707B978AEAFB9AD7A8DC3FA082270C78DF7B9E36748CF4593CFEBD4184643968AB7AB2EF74478D438CE8D093F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0b98351b4ac24600bb5c94856ee10ff5.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:1509792xlwoNb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.379086999117498
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmueAqUQRxsjsmNz0L7:SbFuFyLVIg1BG+f+MunbQRqjdCLKzK
MD5:	EEEDF6CDB8A96CF7252537FFBABE6AC8
SHA1:	0BE435CC7DACD3EB2AC7393BBBD67F298C2981AC
SHA-256:	80A898F10A93746DB4768D8D2F0172B24A6B8B49A07B5628A7254726FC04E72A
SHA-512:	3D6645917A383D7743144A74398944CAEBCC2C490C689FD04143DF728287751F530B1C54C3D875983C319E7B0612F5C3C206380ED7F1B7C6226093D1290D0B40
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d0a82eb578e949c08843966ec939fefc.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:1509794ElN0nb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.410180780787507
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzDRY73QfrXGuxsjsc:SbFuFyLVIg1BG+f+MhY7KWuqjosQu
MD5:	D0089FBA3CAB476F71012F4A01A38FB1
SHA1:	E14FB4D4F61D5B7D76EA14B4DC2B715CEBEA28A7
SHA-256:	5EF993139316DBBF483B662E79AFFC7B121F5D894BE22E67E819E6FF13300795
SHA-512:	E12D6E6DED4F15A0838A216A73251217B4FD08598005AD1973C86BF286D8916D2C9906F8202E1ECFF281EEE69AE7346C098E0A9869AB6B709EE4AD40C482921E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=993534f8d58049d09f61a0daab5d82c3.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:1509795VaGRfb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.348532068243824
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9s2O90dBcai2rxsje:SbFuFyLVIg1BG+f+M22iIcaXqjdCLKzK
MD5:	04A5DCD6ACA85F1BE1C1C8D5ED223919
SHA1:	3CBF55BDE0B384969355858904A92F2DC8927D5C
SHA-256:	CB9CF65DBC14F65A231BBAAF44057291D537AEDD4C4EE2F818C9552D198B7867
SHA-512:	03149C7D75E36B6BB6FDE9F806231C808B712FE6CC567462BE34F92FC4F9463A78FF245991A66B7BD309D8F40BF1DA4A1C4F17A99E18363BE6B692BB39533505
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=70c2d50d91ed4a03acb2def8d9b20e33.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:1509801EM4Pq9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.330042288074968
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6iDseGnEtsDiBbTjt:SbFuFyLVIg1BG+f+M6iDsZisDi/jtWL0
MD5:	E0AB25FF312841D9BA7DEC068E640A8B
SHA1:	262CF0B66C3A68466880C674B9AEC86E8C42B897
SHA-256:	72A7D4D1871C8E4733779A5328FFFB24DE9830F54387B409B91413C469650C6D
SHA-512:	998125DF55DC849E12017438E389AA4427ECE0E46FCF9DDE0F16B2300308BB335E9E290BECC9F2FF0260A67E6ABEA7BCCE25447192C050DB9D8C37F53C8A32DA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=025bf981bcb04fa2a30bfd00cf511d49.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:1509815QAlEkc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.430668981203933
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5XdmuH8uWZF2jsjOA:SbFuFyLVIg1BG+f+MhcuHtWqjNE
MD5:	1B7A24700014A9CE076F1914277A43FE
SHA1:	531A1974F628B3A9C0C45B14103F7733DA7DD86C
SHA-256:	034DD4E93DC5744C7772A4871EA36851FA9BAE6F729769532F3C1A98892198AB
SHA-512:	9D6DDA6E004A19AA9928EB855B31D8569CF888F321B73FBEB6A471ED5BEA9DE2B2111F3790AFF17812FD37C7960A371C4A385F2F6C57DE7D3754B52794F276B5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3f446c154d3e4ffebd2578b16dfdab3d.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:15098169cgTac

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.423291408967526
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvYOB3JcOCcdNGc50W:SbFuFyLVIg1BG+f+Ml8fwejbVC
MD5:	6ADE0E36A2D1CBD0863727564A84DC68
SHA1:	D323CDB29C2F811A49C195D953E9B76C6A539EE7
SHA-256:	96E1789A8B66FE94A2284361CBF49C10D515C3BD44DEDA36008AE5B86B8FA483
SHA-512:	192CF0367F78F9DC9ADB76E02D1FB054AE75F27AD8A65FC6AE408C15D9677FE132E5AC19BB33470FF8161732C47009AEB8BECB0FEB5A9E0F08B0F0699E832B59
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e400cf7d7a1546389427984f2c9e580f.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:1509822vPURPb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.401544689224377
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsBdWqW/Q2uX1SEBYW:SbFuFyLVIg1BG+f+MsBR4uXLBN2jLkGq
MD5:	0617AAE745677EC86BB798F86532E5B4
SHA1:	6F33971D42FFE3C47B21B4ECC9C029D18F91625F
SHA-256:	4D96081AAB675F4D7029F3D5DE8FC7DAEF59544EB2B4F1851F0190752C9DCC95
SHA-512:	8213D2F914459B7B5533AC6CE41783CF68FA389A420CBB49171F6A6BFD3077CD3C06608327C5777027B1BA3759909B5D03D5A2FC52E7DFC9E683D48CF1C599F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fd877eeafe374959bab2773677ceb18f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:15098238GE0z9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.421239224843263
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm82yTE4UcACDOqhg2jsx:SbFuFyLVIg1BAf+M82hkD7hTjNALyAZD
MD5:	BA7B2F674BCD97D3D5A14F31970D40DE
SHA1:	C4ADC5D9658DC86DB97CA1E521054F83B6E50633
SHA-256:	5CB29641EE033C8A0CEC8B13F1E034946D4BDDED571298BC8E7D6CEEFDE9B73E
SHA-512:	C5EBC74174AA1DB8E38AC9C7907C70B31EC4C96B00163DFD1852C195A38FAB9BEFD113D17FE128D49174361EB83B0238A010A92B0958D217FCE9D66A07FF32A9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=667a780d12fa49619e444ddb1f90eea5.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:150982475lAA9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.3888084936701635
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsE6ccMDwwG0huxsjx:SbFuFyLVIg1BG+f+MsLVFw3uqjoa
MD5:	2F96AE71284A5858446318E400D6ED05
SHA1:	A167706F61FE77A4DE4979DA2BDBF368C414A05F
SHA-256:	AD76CE01B26601B4B6E66FD99E4824D6401787C792A0DDE0AA0D4894993870B3
SHA-512:	506180F2A21BB5045C86D21D547937AD353870D73080B8C4BCA57BC6215BFC69EB384D819FCAE2BEBBBE1270F96D7851C807CC3E079C7FDD8233344FEE5D5E35
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fac12d06b4b54eb0a993982feffdc7fc.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:1509825YavqT7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.477454509630123
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxms2fv02FaDFWxR0hT+:SbFuFyLVIg1BG+f+Ms2HpUg6ji4s
MD5:	921C8FB0FEFA236924AC935C6D55662D
SHA1:	F0CC35A09723F692A07E1C8EFD7F98F4FB31AA86
SHA-256:	DEA64E0C55F61746AC82A9A68CF0612D1B409A03BEA41B91263B82287F0C0752
SHA-512:	7F8A2D5AE9D048F0295EB085DEB2317EE409BE48E4CCEAE05D8E3EF92248BF0808D2193B2CC18DEAC48093689D5024476EF87C72DC38F2771C80D665E9A65DDF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f9baa3acc18c47b38beeef20cd3cbc14.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:15098265uOEFb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.438454179043503
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M4BqKGQFNWCTjNdQIeXD:qgFq6g1af+M4BK42D
MD5:	8258D09AEAE921A05B2339B99E321379
SHA1:	EE1E51613CBF1C4739475460A6692043D20CC117
SHA-256:	C4CE83B50B230BCC761466E9B1451BA852B080BC1E2A245B5C9040A6AA8F8F39
SHA-512:	56AE94BB62AC690908F0538EA3BF22454BBD92EB40C40F51901DAEA1610D6F06D9600F69C07418D2BD1C3B6717D24AC00EB39E1673B0B173B711D3DE0CCB1C93
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2d0e266dadc54381a463c95481283dd4.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1509934gFIVEa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.393640276202479
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyDVAKLEYTjs2BZZGu:SbFuFyLVIg1BAf+MyDVdlTjNTZD
MD5:	A6E133A1367A319E678A0E3D838B9285
SHA1:	9A5AD7BB9C3FA283DACB9E44A14493045BDA1DC2
SHA-256:	3D839A05B15D6A4FC6300AFDD33FC6E7C892173D799CCE599F1E13951B0BD40A
SHA-512:	DD33468C691E9C1F6A3DE4CA03EC6064195589DA6C28871F9EFA292F28AF3E4762CF1B7F3E018B0AEE4D6C86EE999CF2775B78B053E830E5C0416F592DFD2734
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=813841c82e8c4bacbbd75777d2486dd6.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1510041MQUITa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.465097073439944
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7BRXBHGGccmfSBdjZ:SbFuFyLVIg1BG+f+MpRccujLTTIWTIL
MD5:	A645885751E9AF1B9A3B17E19F05AA50
SHA1:	E8339A9D47647AE6E3AF55463A8E9DBE75C79315
SHA-256:	493416645966462423834EABBD5768727FB6B5E22A3AD6E7B05FE25F04823226
SHA-512:	9F78121BEEE7ADDF089FA727D9487F3777B3506E86216E4F0679633C942B56B6357BE9E778AE3194892B4E3E396F809BBB6234E5B66D304A8093F28A97E6170B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=13c8132db56c46f7934bfed617d890c6.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:1510104cuXc57

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.386461047444099
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6/cBHEsWZnKjs2q:SbFuFyLVK6g7/+BG+f+M6YwKjNq
MD5:	BC4605975F42785299B16B949EAE02BE
SHA1:	B547437641B65052BF02E45230E6EE2EC2F496C3
SHA-256:	94457F683090CDBBF4028365F1457AA3882DF1C0A26814C195AE807FB6589A72
SHA-512:	A748EDA99CFC0331694E64BF9C513AC2C24CCD2F15DD24E8B808136EE99CEC48E55F61D6E81125F91FE23C4675023F3CB5EA89E77499778A1A717AF3A6ED887D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a39d22ad7a947c0be65b2e5c8eabc5d.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:1510106lNEhrb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.407736865933213
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6eW2SOUiRRMBzZQ:SbFuFyLVI6g7/+BG+f+M6eW2bRRA9jNq
MD5:	7D19B4473D95B610A954F715908DB457
SHA1:	A8822669155D07CAD16EB4BB7D7B7817A3A370BC
SHA-256:	143B632839125DE93B640F8F8004969198C5E5901EB98645337CA43E08C2941F
SHA-512:	EF0B6D16B75F096C016B421703BA00A5DCFF22579453FA02716E2309289E416C00377305CC6545C04677C44F6DF2196A48925F0275E5D1AAC5E40876AD2B041B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0d1ca3feb7df44a1958344a7564154d9.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:6398780jPjgtb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.410383723102193
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8hSUHQRVuNlsjsicX:SbFuFyLVIg1BG+f+M8hSpbjZcHBrt
MD5:	95F3CB532D326CD226A78993150E1C69
SHA1:	16E911F3FBE2C77782688122192CCE24E003833A
SHA-256:	B7F4E9BF5B1B0093E8B3E26115C209AAEA6CE9E769B84C9E3F4B32CB0544E85A
SHA-512:	0A53C8D2EFC6C85549AA30CA1C2F1463EEDF9C7C3EC61F83870533CCF4EB068F841696C87BD8BC93754D62795848D1AC57A410671C81C228779DBC4CDBF20241
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=623d40771b4c460cb663169ba92605ea.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:6398786CuPN8b

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.541441765863984
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M64HAvSRmjFQMzKaBu:qgFqo6g7/+0+f+MVRCTmh
MD5:	F02C8C126733FD2005315F7E571C9C63
SHA1:	B761AA92B3D03342264CCD2B6B31882DC6B11C23
SHA-256:	70F60A328765382C01919D8C31DB3DBC1F2AC1C0E07DBAF7FAD43C21EEDC8080
SHA-512:	6D088EF0DA7CE8271C8018D080C33C256C39F27C842080890871EECC4CF9BA99756D436592827E649A847E5C8709A06DF3F4A0E948232BB348E88B6E0D01EAD6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0a42db01a37c463eb3974fc82553cc82.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:6398788slqT4a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.481103506516093
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Ma4wLqjFQMzKaBu:qgFqdg7/+0+f+MaJL4Tmh
MD5:	64E829FBD35AFD75FC8B1EB5B268C798
SHA1:	07FFB0992927AA7EB56EEDB6746B6DA9AF770E41
SHA-256:	EABDA7B6FB1BC4C79679794C54C21CD34B36CB66C40ECFEBE57BCC22FD63E39D
SHA-512:	DB4F4BDEACE7734F359EB7EBDC23AAB56C9F88E52A0F26EDAE0B39CA3E5BC8DB39DB9607B4AEC19BFB46992F6AFC8E0523A8E222959EA389E21E0E6C71BA002F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c77740f21bb0472db9cac0ea7cb1a783.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:63989687wEjN8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.296205270881049
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9wRRnsVdcCBkRdKSb:SbFuFyLVIg1BG+f+MW0roYTjZcHjv
MD5:	04A5E1B0F5A23620B9AEB13313B5A21E
SHA1:	BA46B6F4A3A6F4A887B77909A066B40109FCD625
SHA-256:	52B5447DA650631F332861B6A622EF2CA5A26B61CED90E91CA84AA20CF7063C7
SHA-512:	2AE359AB493E4F2E6AA45DA45FABB280941A50C703601A1643824170830E359E413F53EAF5DE86C66D43D9EB90352BAF566306E4A789BD41964B7B6A28709A4D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=739e4844d40748089d83d904893f3d32.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:76084vs6E35

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.382892179378112
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/UJSl1R4BUvepSgr2:SbFuFyLVIg1BG+f+MMcXeUaSgrqjosQu
MD5:	2B0F6E353B335F1A35E3D2BB431AEFB2
SHA1:	93076AF4B6DD07FFA3CA26BAFCA4FA1E0E1FCA8E
SHA-256:	08868F6BA57EF252BA12A19C4F99B9E313E97A63B68E014FB71A0B15054BCD7B
SHA-512:	5A0A7D91B21472155126670C932A00644354DD1055E297EA3D8D5047E01B493E9E624BF9CFFDFBE2C2108E500ED4CC31D529A534B49E3134BF328C53F17B863F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=536e5f76b4b045e1bd15b991e0ffd10e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76089ZHSzo7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.365315811564328
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8mCkx8grqjdCLKzK:qgFq6g10+f+M8jkxtgCLAK
MD5:	3122870688A51F37FCC087BF86881C9D
SHA1:	2980C0A0882E60F848BFEF46B9047287AAC65867
SHA-256:	18BD36DB40967BD5B29F5567FAC389DCEF040A3E032A125F830E1607010A9A1A
SHA-512:	99DE518287C73A4C868A76E5CF2F503CE8D5043D1B017C2A31CC5EBE4A7BBC41AFC9362754089F9034891850797152A861700CDCE3E90E124A0F5A99252C2C96
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=68fa2c42d06e40e2a076f873a8b3136c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76095rPjCL6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.325718304073336
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuMUUGRwccvSyshg2h:SbFuFyLVIg1BG+f+MuMoKccxATjtWL0
MD5:	8B74A62A600A13E06B828E2EF16B8541
SHA1:	7F10DBE00C9DEEEB90F54D8AAA9C0D2EBBFA3C8D
SHA-256:	B3D8B9119011F0BA45ADBEB2DB37E2FD934BCD41C0915A0FF58EB749B7A9F312
SHA-512:	14DCEC54A9A285BD2EA8C7781CB45EE8FC732CA1FFC203B62E211C87C2DE34C583446B913F85392140BEB6B51836D31C5E8163D9AEE34263A9CEA81A0FFBC217
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d635e6bcf13d4c3c99e3750bed17ddad.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76288O2FSi7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.512683477042583
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyWGDcSdCEvsjsicWg:SbFuFyLVIg1BG+f+MyWGPL0jZcHcljX+
MD5:	9C1E73C6CACB79802BF356854F853E61
SHA1:	B4897AB884B9B2D648C47D9A80A32FDDAC2DF126
SHA-256:	F23731E0B6F47FAE73A08B3E910755D27FDE4ACF6D721B10448421526C31C3C7
SHA-512:	84538AFC898AC6DE6ABBC84FB8420B4C92755719321135C208E0813600286F56675EA37D5C99FB334F1F951B289383866BE33AAAFAB2F8A57E79FCC16D6071CA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=881d939d6e3c4836bf73075ffe785221.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76289ZixGc9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.43494024777975
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+rXmSTS17VN1drATO:SbFuFyLVIg1BG+f+M+rXmg0NsTjNE
MD5:	E910A8EE0602A212B6DD1DA7E222F998
SHA1:	C0F0C82256738D72C9E920CEE6C33446799B1118
SHA-256:	CDF95E9694A5B2412A4299FB235800B58B5331A137F44076B357D137C08135A6
SHA-512:	6D0580DCB52CA9FF38E58CDAB63C25047B9E0661240CBFEF77300475F7744F155FF5D1E2A788B714095BA2200F506E7C706F89173CAD9A83F536140FE1AB1147
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4712042bc76744949fb37407cbe67804.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76407OAf9g6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.420617035865982
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/ldW+RR0cUXUH7t04:SbFuFyLVIg1BG+f+MuucEbujbVC
MD5:	221D097D222387AB048B5347A9865A43
SHA1:	BF2DCB76B71394C88E0950CB4260368C036F07E0
SHA-256:	14624979DC4AAA48FF10384243449C764A5D65EBFFCEEC511D7108ADFB14540F
SHA-512:	D773EBF825DFB5CA6125CFFD36FD657A0F21B8769E83AAA9749A70694D1A14A3CD162DF6BB9D2E2A1554828D317190A017CC6A4BAFAB139F626436771D3DB9A6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=591830144b5d4c1d9121bbf738be7ca4.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:76469XHqL97

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.396038693898768
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7BpIYomWq1u0hglsS:SbFuFyLVIg1BG+f+M8mWq1Pg2jLkGq
MD5:	DBE0191EA63D46B0E0BDD09E38EF5040
SHA1:	ADC4518641C8229B8680A6FC8C7985F50B4A9A41
SHA-256:	E72FAD7651D889F3CC55E8F4CF185EFEF4363B77769B88341437037EE553E95D
SHA-512:	1775C012000E1757BF9B8B7CF464F29960FFFA12E4B7FE56E0EF0F2BEC9CC3A8ED779D75E52A2EA75A21B022D487691397A86BCAEBFA674A66C5A2F5A9678173
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1247501460474fc1aac9239f35fb1e0a.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76517Cg3ri5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.439668448021638
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4fHI1mEcHOiwsjs2ALl:SbFuFyLVIg1BAf+M42mEAZjNALyAZD
MD5:	7E4778F2D47CB39E9A290968417B6F46
SHA1:	786E612266E0F5FAE12C7D15FC10C6E0315ED905
SHA-256:	AC35FDBD51A730E149D6732CC55D9554CADDB1C609435DA50E0F0DD365C503CD
SHA-512:	28B73EA470A9CA359C64E6EC8EB04334828629F877300BEFCEE3132A7C5C5EB8D55B94D21349622DF9C70EC5F133CB7E04DE62E5C8DEF293F0612597C221C101
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2664cb12ac5a4df486a4ea909ebf723c.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76663FTxe25

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.42134687821679
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmz1B0cS1u1E0js2BbQIa:SbFuFyLVIg1BAf+MlwufjNdQIeXD
MD5:	7AD8ED29A0F8A3DD161BA7FC0E828FE1
SHA1:	3D4AB12F1B9C748F71D7392867E8BF4C13A002AE
SHA-256:	4EA93EA1E3692F5B592C644924394E24D3E78757220E099F5312F28390757351
SHA-512:	85B849FA0E3E6B421FF58078D65863DC6EAF0F93F681E20F519163B003B7EE516F8594EC57921E6C5405CBD57169E6A0D687D20847EFB2A57427E0CBB5FB2FC8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9e3da7d2219746999b37073630277907.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76667N0Lb77

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.4426133693972725
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+nIdSCpjdCt/rRMtq:qgFq6g10+f+M3jCDL
MD5:	A8B3C63FDD39B09CB288BDCF26AFEAC1
SHA1:	0E6A3AC6A933B9E5EEF83227850C6372042F4D83
SHA-256:	F89D11E68CEB35192ABD06838470A61A3AE1EBAC0CECF15032C9EBC4048A58CB
SHA-512:	C22DA3F1B6430D86A0599DEF9A613339994D7D9462236ABEC6E314DEB041FA6F475E69FFDB1A6744947F84066F10806D94F93BB7AE636032ACC84096225EEDA3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=459ffaadb18b4d8795193e39bde5c3db.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:76863loEx98

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.501078725254072
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6tWRMAB5THbEYN2jq:SbFuFyLVIg1BG+f+M6kRBBRYji4s
MD5:	88FACFB366376F6C46C20CA93317A6B1
SHA1:	FCD543687BECDDA4957D57F3D81FAB1629F987C9
SHA-256:	0360F96C06E04C08E4A340924C4E30AABF62C946049462C8137E7FE20CBFC27C
SHA-512:	B197665C7501D011BCECAD269CBF516B1E6078F0A0C5C60867B4376951397FB84AA1C3065402167DA1095451EE4F21AFA30733F703FBD139440A7B099670C52B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f909f34360e417e96b2d9fc01cdb91d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76864lDNlR7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.51976724991344
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp+H1Rfi5NyMqjs7LH:SbFuFyLVIg1BG+f+McVRfmyZji4s
MD5:	681EF0081CD538C241D6A787C5800A17
SHA1:	9AC4C8282ECB3AD904C00A8DF1FAEAFE92B6B192
SHA-256:	57CDC87F82B6BBCE00227E484EFB5058547B3D2031EA8C6E341AE09036B42C2F
SHA-512:	5EEC62BDB9956486DC26244020323DA8D4016FD5AD4460B0C8FB6D96FFE87F57D00EFB47ABEBDCD0FE64E0FBE080DE7AF66BEE4F0273BE262ED99E7756D2CEAC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c396f7b9a4a74b3396107f8ad2ab0bbd.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78327Nwc4p6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.386903431735832
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mo2dXVRU0XX7jdCLKzK:qgFq6g10+f+Mo2dXzCLAK
MD5:	7E09EBF494715C61C3C3B979DD534D9C
SHA1:	8FC5853F8C5C6F24FBAA9CE0365E126984D2C6D0
SHA-256:	2D4F153DAE19F00903DFE27C759F7EFFAF2A8499DB0CA14C5F99D4150BA52DFF
SHA-512:	A8316CCB1810793194AB802460ABF466A546EA87A267980CFABF54C06D51218D656AEF3BBB664BA3C4EDA03C307A9461472FBE9850C1CF3CAB6CEA1242E0E208
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b45fddefb1604130b3563942105ff9cc.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78337HiS0F6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.386977448061191
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8J9zEiadWxRjosQu:qgFq6g10+f+M8JaiaQQu
MD5:	AF7A112DBA367375862386DDB3AC7D47
SHA1:	B775452BAF467142700D6F605960628E41F5B840
SHA-256:	B1622707A2C866F3CF4252CC7DBC0406F63C607EDA09BF45E84E78319CBA518C
SHA-512:	819700F444A8ED5D7A3EB058AA5BD796D6A69DBB5B760ED795141B98E522D45FCACB955653CD8A1363E9D40B586E2227E7D7348CDD3B619A445471A82C458C58
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=615bcc4f440a4a638a6da9f8e16ae436.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78742RH5ckn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.506371016427012
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7Z6cmiMDAQVI1Kls+:SbFuFyLVIg1BG+f+MMiDSMji4s
MD5:	DE158322B0A586121D2633C93BA9ABCE
SHA1:	0CD1E6B4DD78E8BADAFC85FE8E9B90F741C09248
SHA-256:	FBB7C3E2A9C3FDAA8C1D25DCBF27B0040954B194D2416FA25F5D35F0FCBE6C6F
SHA-512:	67D8F669D90C3E9D3B9872510E79479E870CD5038DB5FE7129DC49C8B092488741C425EC6B5080DC256928B1543BA91A67779710E9581FF142EDDDBA1AA00833
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=160e9690909d4a038fe53065bad2cb51.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78743dSlzvp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.501376745074337
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mo3+Yqo8jZcHcljX+:qgFq6g10+f+Mo3ioqmAu
MD5:	980EC3E160FBDD8F615B0CD5EDADAEDC
SHA1:	AD7CCE90CDBCAE95494A5F5B9818CBDE3030A22D
SHA-256:	8AF619AD5CAED60B4712FD7EFF4D525DC6B34E4B7B23D7994174EA5796DEA314
SHA-512:	D46829C87B9F9A14B94E2DCEBB4BF0294EE7AB65A6424B8F8B642B2B6DCA923B3375CDE4879E26D9554B610D398A080F33D7365EFE06C87A606243F288D60235
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b3496f6bfb014a3e9cc9137e75f2a643.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78744S1LdHo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.368075008466279
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm81DKn1BFGiFrxsjst:SbFuFyLVIg1BG+f+M8xwBFGi8jdCLKzK
MD5:	CE0503CCC638AE725412FE9B3A995E54
SHA1:	D517CD128D0C86CA388AB1E294395D8E20571F62
SHA-256:	BB1CEE592533B825CEB7EE4316861FCDA9975276764325FC184040CD4A2AD8DA
SHA-512:	9537ADC79334EA2B96DF742726BE2292D5505B1DE6869C7361F07BCF332ABBBD9456C266A43CC597A21B7159C6E59E95C074C9BC9280F9C19D84696167A04996
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=69adbb3f1a51439f8ffdcee6598acfa0.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78752Zh83Kn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.415838165215959
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrAiH6kxGIXTqjs1Ha:SbFuFyLVIg1BG+f+MEiHf7XOjosQu
MD5:	2809FA2C7C29E46B2BD278D2927B60FC
SHA1:	B8AD54AB3033B89F8EA51AAE95D968C742EA8854
SHA-256:	7400E011AE8F55FCEB236109767117910A46BA5B6DE832834B9F5BCB961628F9
SHA-512:	DB373A9537F77316CA9A6E97EA71A210A1C33CE68322098717829CCC25777E745BBB9600AE1BD5F14F39307F02390BEDD8CCA875F4946A34E3F48DC65B47E9D9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3b6714511fb4751bfef25a2cf0522f4.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78770UniyBn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.42931960015455
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9uJQaXgDlsjswkClK:SbFuFyLVIg1BG+f+MIwajLkGq
MD5:	73602EB5AAB6824B71C96DDB5527463A
SHA1:	29EB00EC6A38301D7EFC364B995BF0DF26263879
SHA-256:	6A6A46DDA4B7868CB2DA659F62F23CE247AACE09F0468E47BB742B15AF0D50BE
SHA-512:	A37BC842C353023ED1CB8071DFBE0FBA9251B2637C2D62B8B6ABB9F8AAE8D7968AAB3B9CEF10622ED72C7659A15E376B5D399AAF5CDB8B0FCB2DA3816CB4206E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=79556b736cf3412db09f14ab25b59b5a.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:78773BDp8Tl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.408273998362391
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+uzepJG9tsvshglsjsx:SbFuFyLVIg1BAf+M+oeput9TjNALyAZD
MD5:	72644CAAAB7175E30F2ACD00A915EFEC
SHA1:	9D247183CB1BC445F5E46F6C4360CF660BE1A958
SHA-256:	85ACB298D080BDC5896FF73A307E6B623720ACF9FEFD8FF172457AE5F3C113CD
SHA-512:	71E9CC75FF0BD123B8EA798173A5F432BA289FDD3E61C2C8844AD3B6D0CEFBE2AEFEE4CAC0433DB3C235B494488B9D529EF1F600A24676B35E877F684F438D29
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4c71074875f245ed97f04cfa10ff2a31.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78774L4Dtul

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.55031841131392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrMIyxQDQcT9s2rqjq:SbFuFyLVIg1BG+f+MABQDQcT9Rqji4s
MD5:	48D8BBE4D759A19F33375854BAC8C30D
SHA1:	2372D763F36D6BE439B3D2D883F703F1357B13A5
SHA-256:	3DA2B788A760E50F14837A1CE156A891E168543BBCE402C579037FC720C51F08
SHA-512:	F6E5D90C7F0F99B284CB95D411AF2608EB6B7F14093E7C845892F726DA106F13ACC5008C999CC10732FC102768116210C7C56D0DEEA2C61EB2C357A6F767C998
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a36058cc1b4342f596228db514f30119.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:78783QBpwil

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.424649560738212
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7x2/DEFRzAKwRFIvsjs:SbFuFyLVIg1BAf+Mdrz6q0jNdQIeXD
MD5:	28A84ABD998DF4B41B012A36E63560B8
SHA1:	34B10FF75B5EAA55DE15D40D4C9FEC7869C1271E
SHA-256:	EE4425BFDE1E2E06D48559870ACF62743AAF33AADB845A7E5BFD9CCF9471FD72
SHA-512:	4E3A6E14127A42170FC706F845E4BC69440E81B3B15A25A843670A663C9F7BFB158B7047E2109B7F550B48BF7040A7172CB2401BE71561C68E35BDC0D0B893E7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1b4b3a3f180d44faa8e82f3b4386206a.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78873jRK1H5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.407238107191908
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5BWcTEjVcbkMxsjs2BP:SbFuFyLVIg1BAf+MZQcbkjNTZD
MD5:	D704F39815F0C8D1F738049E9A9497AC
SHA1:	8EEFF39DB119EE0F1905B2727767C7F3E6D0D7DB
SHA-256:	52592197FC1FDA5678E233D1C7F4CC657C330BBB98DED1F6215FA054DCDBD1B8
SHA-512:	E5E9B58D2C15DB5C246AA3C4EB2AF67E62D2EE51803BF455F9B684292B8495E668B29A05810364AFF1B07CB89AF0B1A9EEE743496B713BA9EAF972B963E953BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=30b76ceaeff94ff6a0d6f0f586b29322.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78967QxCII8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.442791332540284
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoUYzSjSwz88jLTTIWTIL:qgFq6g10+f+MofGSwIsEWEL
MD5:	280A7ED0F28B3D4201DDBD4C90D4366F
SHA1:	F3D8D3C24E333C7AF6E31A890A7CA19CAE6C27C0
SHA-256:	71AD61632C4423F2F261708650889230200CAFA279CA30AF98684C70B31A415D
SHA-512:	D862711B7616325B649707BF71106C1314F0929C50B77EB70638C44176D15337EB88C8CD839B81567157BE9ABA0A8ECF4736912FD71BD9C9BDDF35F4648F303E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a476f33b74dd41d7af775274b5455f9f.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:79038zVKVG8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.457446242519723
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MKBlWjxRSGB0jNq:qgFqo6g7/+0+f+Mal+xRSq
MD5:	C18C9FF157EB2E2E2A51849439D2A50C
SHA1:	1810D50E73C0CB98628403DF60BD831E4480D21A
SHA-256:	1B9B1E4F343B6CCDE4F83E3248756E5962521B0D5438D235C50621DC339CE532
SHA-512:	C1583AA747BB3F0A1DC6CF2192F9B475D22FCFD5D01EB792B2BC04FF3EFC3876022971691AE69F11714A9CB07541B609B151D4F35C3461577C750FB39B0AA02B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38acc79d44034b1eb26f955bb54247cd.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79040qVicA5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.385103803821073
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9EQXaUGiDgLK8jk:SbFuFyLVI6g7/+BG+f+MeQqKDgLK8jNq
MD5:	B53C5EDF899BC29C23783F7366113ACD
SHA1:	243822B701F1A1D5B3052A29DA3842051D5B2BD8
SHA-256:	21B3B75D95A2761ED5A5B64BE14D167DF0A87D540C07A2967A4A8A079DF441EE
SHA-512:	0A9631B54A2C2B48C1859FDA6FFD096518F2CF554B5F336AA6BED51FF72B49B6DCA8EF7B334990469B107940CFC30BCB34FED7BD6C1CB6C426A183968690F69D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=72152117d66e4dca8104afeb590e0ede.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79096RVTV07

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.537049249191591
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MIIJ/nrnTjFQMzKaBu:qgFqo6g7/+0+f+MIwjNTmh
MD5:	6B386060930DD71EC07E7E8008619E62
SHA1:	EE2A5A60610C69494B66E011E1F825E871F16F43
SHA-256:	84A35FC0E1AB76AC2CEAE4ED600F48AE0E671901CDA21DDB1670EACA30698E6B
SHA-512:	B0D294ACA3C3D74053B6C0BCC04E3848FFC3DA24B72E65EF1A664BE654463F3C5AE3FD7F97C17B6904C3DD47ED3A485E1B0A812127A62646B74B82BAE62F1380
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7cc3bf963fa74658a7d5994191d4d834.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79098IR1sh8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4799194585375846
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4jQajFQMzKaBu:qgFqdg7/+0+f+MEXTmh
MD5:	B82544164ED117E76422ECBC5CF4864D
SHA1:	7E7C87D957EAAA278ADC212E69741E3776F48A7A
SHA-256:	23E35D178ED2846EB024A78673DDA3A04AF81A418F248FBD7E0399A77639D249
SHA-512:	258D21E2686627C6366406105171D2A163C1C46A6AD75BA3CE3854E4AF716EE0E3ED80F36165912375A2CCB98820B585F4315F59C98B7AD18DE5070C22246273
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a5464cd9bd7c4a309d3cac6059dbf92c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79170v7TVY7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.396719989331825
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrmAnfWd8hBcY9WvXV:SbFuFyLVIg1BG+f+M6iWdGJljdCLKzK
MD5:	1A4D9C0F28E3C8701DAAE7577FDDEA8E
SHA1:	B8109C32D333591C576141399342C05BDBFC67BE
SHA-256:	18B5BAAA1C8D1C846D592076A17698364040A3265E22E41909E7AF04B3AA7B12
SHA-512:	5E29425F37C946B0740557F9C83857B15AB5CF52B52ED55D5004073D5F2E126F519C2B27EAD65A9A15BD47E2E04E785A4A8ED50A2D2254436F97EFA88A33B164
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a4ec27a21c364fa4bdd96118b79af023.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79234xEgNb8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4065339812601465
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp5HvMKQ22js1Hadme:SbFuFyLVIg1BG+f+MLU/josQu
MD5:	D144E2C636D6567978B94B2042BFBE05
SHA1:	9C00A3B81D3175E66BD1DF1096407E44315B5B7A
SHA-256:	3587F205F6B2E9E6A07CACB62377B408F666E3C4C54ABC7E45C7357E171B5B91
SHA-512:	EB9A9939DABF60FF5D2C283E03CA849DB54C38FBBA5A92A7E40BE2985169C10B3A199583D5096AAD035868499C0478C50AA33B21B239DD5F171CE13EF27F9208
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c2594161b90343eaa81c032fe3a20e96.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79259YS12R7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4153596380990665
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzxdww0d0B2RDvATj+:SbFuFyLVIg1BG+f+MAwQl0jLkGq
MD5:	E7CD3C52A431E7AD0362D9D7242CE03F
SHA1:	DE1672A10FC3ACF96F97EF94AABA987348CCEC42
SHA-256:	7C8FEA4AF18A54D85C6B7917C575799A7E36D4CEAF250C6DBFD4D414B8511FCF
SHA-512:	67F3CA1588737E3B86244FD150811A7173D1422FC0D3E3387E480DADE1C819269EBED34A1799E32CDF6320D3025F5DC8E2A98B9DD2B6E15152C5EAFCAB6B088F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9dd9bc8dc089447c8c575dd347218acf.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79370vZdPD8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.444530211316716
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8mGHURGEL8xNlsjsV:SbFuFyLVIg1BG+f+M8mBgOZjZcHcljX+
MD5:	5DB51E00EB832898B26FF144311F5D4D
SHA1:	03AD63FED6F8ECBD0320B81808ACD1CA4C0CB4B2
SHA-256:	A3512FD5EBBF04628318E0987E14A559BDE965E708BAA8D2B1145E1A48F6D067
SHA-512:	7893CF3F2F34557DCF7C9C1DDBBB15865D0ECD5084E1281178A457B0C0B5F5CD4C0D04DD59C4E1F189EF4DA0E1F7FA2669BE00E601947ACE145D64CE9AAB1E6D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=692a16d4eb1b42c2b11cb066461a7bcc.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79485GNXWB5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4297790295273245
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyG8B4RpGXUlfUJ2js2o:SbFuFyLVIg1BAf+MyD0ts4jNALyAZD
MD5:	2A21F97B4A4F45E44C0C6A48173751D4
SHA1:	107BC45E1B109A6D35C621B7AEC6F6915D4BCDF9
SHA-256:	732EA3CABDB1E13BDFB57CC1BC805DEFC80D7ECF5C957D5BE6E9CDC5D3E5B281
SHA-512:	E2B0A471F70071CD7974526FF6BD860BE40436B9F130DD70DE7800CB76E14B4DCCEBEC5D63AA64EC02A223935E970017929DAFCCA580AA4656D739E50BB3D7BE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8ee9a07df1a4480d97c217363136c9c5.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79571Wpbgh9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.481399174250235
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+My+Uw3QdK1N2jNdQIeXD:qgFq6g1af+M133Qd6NM2D
MD5:	490DBEB4164FB3ACB7853BBBD84D42F1
SHA1:	9E9C9FB9503C48E3D96085F79CF3629916A65A6D
SHA-256:	FB5EE6D1ECA81E502CDD6B745B10AA06C7CD13C56EA0EB4982EDFF172816EB7D
SHA-512:	A6B84F32C2FE965F211E1A8D5A29C8EBD110A1A62D8270B096A636214834DE475E02701F2EB6C5261007639CC02DA294616EF0D91ACDD0331287D6B953DFE28C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=86406bc817f343458610b356a54027de.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80693XqutHm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.418454240743362
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MYaliZ2rqjLTTIWTIL:qgFq6g10+f+MJliI6EWEL
MD5:	9FC0989CC6464C495CE62EC21CD031B9
SHA1:	58CA46FB617BCDD3EA14760D682FFED65BAD088F
SHA-256:	470A66E8E4509A997D3C41CE234A21545721A93D79EA6F595BE06C450BF70701
SHA-512:	AB26096124AF89B0724400421F483A6CA1F06A43A67703B92A43372EBA206A6E9DA143E7E7BB99416AF2237A27320FCB5D7962A0B3FD5A1C844E23945898DD0B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5333fc71ba0247c1a5e2b61d354b41d1.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:80789ieuNsn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.403179442838676
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8AeqdgI7xrqjshKJg:SbFuFyLVIg1BG+f+M8347xrqjbVC
MD5:	4C3118DD8E167E873A04289BD2F42BCD
SHA1:	1CE99BBC893BF0B2D78C4948BB981D934F3FFDC7
SHA-256:	0AD762ED1C9B8EA78A843A4AE8D966A045CE17FC6AA3574AE22B3EA56E2C5FE1
SHA-512:	8429956DABD071A0784F14A9A293031505F85E23E813A2C5E18899F5A65F98D23BC3B0F7159C062B464E126C3349FB441965B3B3F059C63C3C6E1604C39CAC72
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6e172f3d989048058a7a8faca1af3267.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80834vjgo9k

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.39628744211535
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmokfW0d3VtBJq0jk:SbFuFyLVK6g7/+BG+f+MosdJq0jNq
MD5:	5966459BEE9A732C4D9F2CE0A9FB9A92
SHA1:	0BEDD108399BD56D3AF20570880E6CEA296EDEAB
SHA-256:	7065B68E550F3CDF30AAB73B3E86D49930052F1C9B9A0B30F0E81A105222CF79
SHA-512:	1B8B19072C90F4D9C19DDD598B6D6F32C53452B5E65669CB062BDE93D1617AF11DBDDC88F4AF2490C8974534E406607573111724E10A9C83FA24C37C8B1F1832
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b334f049ff3e426db200b8b7cdf0484e.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80836HEkQep

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3640788526923044
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm7jTVHiGR0x3B/8Q:SbFuFyLVI6g7/+BG+f+MLVFRux/8jNq
MD5:	19E193ABED30A7F52F6B5B069F5DD51C
SHA1:	D04879D078305C0E3FCB11CDB0E791F464049C4E
SHA-256:	3D9DB7BB288CDEDA8FAB599299CC8389425293FC2427795E8F6D3C45DEDFB5F0
SHA-512:	85239330345325C6896FFFFDFB84B0C0A06FD429F416DBB92534F1FFFEBBC49DBD69A68E6F10A00B00CC26BC6C3CA4AA5D571B2E01E0C5D429D59D0E283EBB5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d063243a1b241c4b10165d11db436d5.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80878fwqUQo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.560964934769269
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MosOWlXoQYuqjFQMzKaBu:qgFqo6g7/+0+f+MoGoQYNTmh
MD5:	2B3F67C16A16B019C0C776D428A54BB3
SHA1:	A5166C52ACB69654B4D7040D5F107568D7F516DD
SHA-256:	06CE563A9572B0F49A6909F8C04A024E7B5E6328EED87F89BAD0D73ACB4505A8
SHA-512:	0130A338BA16855BAF015A7DA63C31A29141BE774C704C7F42CCC98F7C78F5223C314B6BC383FF32ABBC3E6DA0807FDC345BE8CB16024F7A06CF6A1BC2B818DF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b7cccf5b65034cf3b417d940e2822925.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:80880uzSBjm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.462461685956129
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4EVRyW0jFQMzKaBu:qgFqdg7/+0+f+M4EOTmh
MD5:	E8B5989FEBEEE03F402BEF10E40DA818
SHA1:	67AEB222CE031EB4C5DAE9C16D73548A9BAC8EC9
SHA-256:	C1EC4AE989558BFBC98D332ED3DBFE04B5A019004BF22B09D62A021D6040A822
SHA-512:	1DFCB8AE369CC951C112C14CE9D99478B397260323862EBDF12486334EDCA8AF65763F94B755BC26659ADC9BBF0A8A841428B274F1FD97B8537F2908A0EB8C0D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5601cf52021f4665aee5fa04dadfa4a7.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:80910jTfvuo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.401518650546553
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm43Ih30DhWjgQB0js2BP:SbFuFyLVIg1BAf+M43K38WjgQqjNTZD
MD5:	B52D2C9D043C5C7D0F231C5ABA121636
SHA1:	FF006CE0A0ACF8390A386C383066A82BCA590725
SHA-256:	3A98F4057EEB41201B69F68FB26DCF4EB69A048BA17E2BDCA32DDFF4A3D1FF27
SHA-512:	4E6F89D332DF67BEEE77CA901E8EF738D41C91D7890F2867442DC4C1024B00E97D4160DA78DE60882CF055EE4B048D44C769AB772942FDEFDCE9EC9CD9261D08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=25d7fab427744a87ac05bd3b462d765d.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:8198183QyHLGa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.316402612985499
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6qEVExHRcedQSRTjt:SbFuFyLVIg1BG+f+M6q8EtRcedQSRTjt
MD5:	745AC7E8FD2935B160530DDEB98F17D4
SHA1:	728AEDA815D39FEAF02280A6FE5397ED85E5D08B
SHA-256:	6366D8B6D3A64647EC3741ACA622EAAD2F152EECB73F80D2E64F5BAA212D9BE3
SHA-512:	4CC40B3295847DC676E0B7D514C4910376F791A8548EEE14F9684E88863CCD3B9431C11D73E1FAFCE211464BE52745FF88CB5E4DDBEDEBD52435A7A1B097B8F2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00c4507a0adf40f394dd2b90ee5b857e.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:82186D6EJan

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.388549662266633
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmujTbWUGccRBWB1GMm:SbFuFyLVIg1BG+f+MuLig3GMqjoa
MD5:	91139476B982366774C58BC21E65F6C3
SHA1:	52D9193EE286D302CB4A89DB14E74A3791C1E50C
SHA-256:	E6E9576A56A276441FEEFB5B85188B9FDE0BC62EE2E17A9E70B0F836CBB9CF2F
SHA-512:	F32EA4C8976AF8ED398FA7BAAD79D47D4CF72EEE3AE7965B0B8A7EA807AD2FDF1D1991EFE625E6CA4E66980A036AD013228E0DC468014024FA44CA088F674CF3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dbf3977d664649a9b7bc99cc8f3de519.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:82195TWP8Ll

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.341694567784242
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz0CHcWCGq9TjshQJT:SbFuFyLVIg1BG+f+MgICGqNjtWL0
MD5:	889F25427203EF4617320707561F6ED4
SHA1:	AEC5D7D082ABA9CA0E647D74A117A74C3456B129
SHA-256:	695A3E544DB0077988BB5DB7C721996B07BCF946658B183E896CE40E1D0F63E0
SHA-512:	86C29551831D9C48CFDBCA17B78A9153C8FFB4B5B068E6A86E84A5B1617EFC8FACFA42001B84359EF6852C21D5A6DC1CD7949FD79DEB9FF66294C4572282FA5A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=992fcc08a2ce4d9386868d92c5cb8a98.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:82314wknfHp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.45203899053146
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuKKBXGcR222jsjOdy:SbFuFyLVIg1BG+f+MuKKBbEjNE
MD5:	3FE2D6FA47C71AEA616D4E79DA74137E
SHA1:	7043A967BE8372A5ED5CC792E1A904D47039824C
SHA-256:	686C36C36DE59D5070BB8EEEB247572BE5687F1AE6EDE018631706BD5CD5DB06
SHA-512:	1F317A5BF99D163DBA0E28484919AC5727AC88FBC05B93B4EEC0DAE80EA1FAE35361273DB4A804CE7E75F1BE1C147455D80C26CF3D49A9657D26F77785BB16AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d6c289714d5e48fd963f657dc949071e.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:9170410JcXdkb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.393330996168963
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/pRkTDcWJEuPsjs16:SbFuFyLVIg1BG+f+MBcAk+joa
MD5:	4560674F4B33BD017BDE2CB7B25D8159
SHA1:	97CE4B6B929053E5EFD71E92BB2E9141B41BF7D5
SHA-256:	78E4257877E185C30F87A960BE9EF8CD56DA60498923A90E86DFEE948EC0E615
SHA-512:	E3C7F825B2B7AF4978364FE15F7229BA6591E8BDB332B37A8A73A4B3F10B9A3687C0F36C09BDFD11A5719DD5E49244F7BE016FDF27358A169264EAC7BDF8501E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=54394726f9294fcebac4fd9980a793db.IDENTIFIER=dbus-daemon.

/run/systemd/seats/.#seat00il8rn

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat02fKzTo

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat03DeOMD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat09z28VI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0fkjI1l

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0pI63ZI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0uBGd1C

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1270U4dWm

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30752308411329
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBgc7udrIQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgccrythQHtPYq9M
MD5:	961D28677333968CF9BFDDAB5B74DD3A
SHA1:	CC2156DB933F5AB72E2C63BA124B749240825B31
SHA-256:	0D531EAFF57E81EB336D3464FA6A8DE315ABAE9B3D38C8D866952F62F4EDEAF1
SHA-512:	CCE2CB0B4457A39AE802D1ACC5D946B09539BC08B6E2374D811CD9B6776F14A66030E820C6442D0BEC490E7F7DBDC9EDF36B1117DA97D320C53CA2CFB583B67C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1733950688664364.MONOTONIC=489741163.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1270WCZgI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.305990447568859
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8sfJgcuPQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEagckthQHtPYq9M
MD5:	3904742BDCB2B223D07F6052B8FF0717
SHA1:	82290433514F2AAD257E9E855C527D4D8F34A4DD
SHA-256:	A886595B7547703125C8E3A939670D3B226CEC72B68446F63E23245502D67877
SHA-512:	FE3E13A5D23D4F0B3867897F80DA3896D9EBDAD51D538125853B72A7A3B758A1B76302D8685A48D01796BEE4045ACED3BA9D106C99573CA463942787B710BA05
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14494.REALTIME=1733950800524028.MONOTONIC=601600827.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1272SjzpC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1273KBsyG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.305990447568859
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8sfJgcuPQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEagckthQHtPYq9M
MD5:	3904742BDCB2B223D07F6052B8FF0717
SHA1:	82290433514F2AAD257E9E855C527D4D8F34A4DD
SHA-256:	A886595B7547703125C8E3A939670D3B226CEC72B68446F63E23245502D67877
SHA-512:	FE3E13A5D23D4F0B3867897F80DA3896D9EBDAD51D538125853B72A7A3B758A1B76302D8685A48D01796BEE4045ACED3BA9D106C99573CA463942787B710BA05
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14494.REALTIME=1733950800524028.MONOTONIC=601600827.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127BDBJHA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.457416125952192
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff0QgTgcStJwTWExt6uVv:qgFq30dABibBcQCgc+oWExIuF
MD5:	6807A9E0BEB3E0D0448BB6B0FF420200
SHA1:	210A79B5343C6F3618AB68410690FCC6C445CEC3
SHA-256:	DCDCEDFB539C37090116378D927E637522E536AA814A7C0AD6FBED450311E427
SHA-512:	3955B9EBF345CE734E558D4D32BC3F29E67BF737DFD8783D583B6C723617A5FB693425F68206988E1F9293F6B2872FABB19E76EA0C314C3289E1851E65927A2E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13638.REALTIME=1733950732360062.MONOTONIC=533436861.LAST_SESSION_TIMESTAMP=533501810.

/run/systemd/users/.#127DbDyND

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29645159673236
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffRJgcStJwTWEqKQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBLgc+oWEqEthQHtPYb
MD5:	2CD461CCB67BC621349CBEE19647E051
SHA1:	CB8FE17C284D37CE51960A6DD2624EE702530614
SHA-256:	C7C50BFFFA3C261403C175FEB63BD80C7F562CDE4EB7160ABEEFC8CAE7F2DD69
SHA-512:	717121E31F2599353355FA5F85231010046FAFD0E3B1F6FCBD84EA76CF40647BC10681EEB5A3A37E81DFD35D3178F15AC4F95A9FEA0696C255FC053B8975CD37
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13576.REALTIME=1733950732360062.MONOTONIC=533436861.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127FK3kEz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.29645159673236
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffRJgcStJwTWEqKQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBLgc+oWEqEthQHtPYb
MD5:	2CD461CCB67BC621349CBEE19647E051
SHA1:	CB8FE17C284D37CE51960A6DD2624EE702530614
SHA-256:	C7C50BFFFA3C261403C175FEB63BD80C7F562CDE4EB7160ABEEFC8CAE7F2DD69
SHA-512:	717121E31F2599353355FA5F85231010046FAFD0E3B1F6FCBD84EA76CF40647BC10681EEB5A3A37E81DFD35D3178F15AC4F95A9FEA0696C255FC053B8975CD37
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13576.REALTIME=1733950732360062.MONOTONIC=533436861.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127SCfvhF

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4838239769325945
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff84fJgcuLt6o:qgFq30dABibBE+gcWIo
MD5:	3779C493D241DA428D8635A8274E0D30
SHA1:	4578E53E82CCB2161492B11A11FBBC30E4A1C142
SHA-256:	4FCA7AE58B93E73B65142CD73357571100E7D527B4C5EF8463ECC9E13BDF78D2
SHA-512:	0E644511C65C500C42F43DCC24BDEBF915BF2707ACD77C3901D53CB8633477DBABF8E570FEED27C2D6B33DDC845FFD92F7E133032D4458655E7BE17244D58137
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14616.REALTIME=1733950800524028.MONOTONIC=601600827.LAST_SESSION_TIMESTAMP=601993790.

/run/systemd/users/.#127W8s75F

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.32227106636078
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGDdVidv3+WBIo206qodo9:SbFuFyL3BVgdL87iesnAiRJgcuLt6o
MD5:	CC804C1F46288B3DA5F7A1CACCD84DE0
SHA1:	E01E349467715E8C9862B2DA827FD5121FF1F1C6
SHA-256:	42AE015EA8F4CF7D0EAA4A31DB2301B2F00610DBA821C69B3021BAF9F7F3F8DC
SHA-512:	F9E280F37761DBD5540CEAC67778F24C68A57C8451668DB51097BEBCD1F80FD8027EDA234DE947CDA140922AACC41F388F30136E2C989343213B6C08A0C7622E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733950800524028.MONOTONIC=601600827.LAST_SESSION_TIMESTAMP=601993790.

/run/systemd/users/.#127eXcqHI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127edhL2n

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30752308411329
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBgc7udrIQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgccrythQHtPYq9M
MD5:	961D28677333968CF9BFDDAB5B74DD3A
SHA1:	CC2156DB933F5AB72E2C63BA124B749240825B31
SHA-256:	0D531EAFF57E81EB336D3464FA6A8DE315ABAE9B3D38C8D866952F62F4EDEAF1
SHA-512:	CCE2CB0B4457A39AE802D1ACC5D946B09539BC08B6E2374D811CD9B6776F14A66030E820C6442D0BEC490E7F7DBDC9EDF36B1117DA97D320C53CA2CFB583B67C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1733950688664364.MONOTONIC=489741163.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127gRdE6n

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.332043500784173
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGDTddudrqx4EUKoK9H206qodh:SbFuFyL3BVgdL87iesnAiRJgc7udrg5U
MD5:	07A57C45F56B435E96339598D5679C75
SHA1:	EA6C5B794926EED1D17A18B4DC52DBCF5A182F43
SHA-256:	E96F5236D0FB09CA2BBBF9549F9FBE2B65132FF51ACF968D0DB4C19F828EFA86
SHA-512:	311905C7CA9A4B0D1E71776859825352EF74A30255AD2E8A5B9F690F39E527DC5202DB6B439420F3CCB2981ED1289AB2464911D53836EFA3A6C3908711DD407E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733950688664364.MONOTONIC=489741163.LAST_SESSION_TIMESTAMP=489808992.

/run/systemd/users/.#127pyVvZG

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4838239769325945
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff84fJgcuLt6o:qgFq30dABibBE+gcWIo
MD5:	3779C493D241DA428D8635A8274E0D30
SHA1:	4578E53E82CCB2161492B11A11FBBC30E4A1C142
SHA-256:	4FCA7AE58B93E73B65142CD73357571100E7D527B4C5EF8463ECC9E13BDF78D2
SHA-512:	0E644511C65C500C42F43DCC24BDEBF915BF2707ACD77C3901D53CB8633477DBABF8E570FEED27C2D6B33DDC845FFD92F7E133032D4458655E7BE17244D58137
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14616.REALTIME=1733950800524028.MONOTONIC=601600827.LAST_SESSION_TIMESTAMP=601993790.

/run/systemd/users/.#127zQ15ln

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127zrqppD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.308107885632561
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGDStVbwq90WRE1H206qodoVv:SbFuFyL3BVgdL87iesnAiRJgcStJwTW+
MD5:	5D9E2433AB1DAC1C4AA87FBCCDDA6F90
SHA1:	528B1249713F79E6D450ABD307F8B37CFF0B2620
SHA-256:	AFCF0546D1FA7C34B5F661242CBCDA244D18EE217EAD38B8A4A5200335F7A0B9
SHA-512:	19E1E468F085E9BDEBB94AB7C8A1779D96F1022C8D876182BF2E29BA7911D6D2C998059308DE7523F5EB4817C8087072A4B9DB4C13FE893FAF1432C194ECEDCF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733950732360062.MONOTONIC=533436861.LAST_SESSION_TIMESTAMP=533501810.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:H/:f
MD5:	1FCD2828E45F9AFE97FCE1C81C9BA33D
SHA1:	3E108068AE02596A5257206EB358B68577E3DBE8
SHA-256:	421740BBFDCD0869A89C8D04A67C94AD635628790BC8C6E7B9F4CDC0D034BF63
SHA-512:	EF56DD28E16CFC15D68E247DE5CBFF02C42E441E22FF280765459D856CD1A540262BD9274C906D78FBA9D5855180BEFD40DB45AF5937B73D5C307B184D95B17E
Malicious:	false
Preview:	6972.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mT2:mC
MD5:	BB36859EF40AD2F4F9B8CE45D3C16A51
SHA1:	1DA253F50BCBF42E00FDC23DB74CA7C0BDD80B25
SHA-256:	5489E7EB4E62B0ECF42E30A9DC97489B5C8F51255442A211A6F4717727476C3A
SHA-512:	BC1ABCABA4788F23D5E0E1EC555B76327B5DF7F270098FFC6FBFBCC3CFFB3BD57C05A4C5263621F2B5310CCDD9AAE3ACA3DC8FF429E39A9EEBC8C4BB72E798E9
Malicious:	false
Preview:	7061.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:fRc1sXlXEWtl/4Rtl/:fRv+ylutl
MD5:	8A1C80B37A9F8F3D8E31FC96B7B66534
SHA1:	30D3A70BE1E9C49F76318AB3A4FC1C500AE852A3
SHA-256:	E55D3CFBC27C5D15A5C1E23A0896139B6714C828914459F6F68D74E7622420EF
SHA-512:	3E9F550AF70958A79C512EB766B1CF15BA15454D7735F4B8731B51F7C9638AF0C3A3043635771AD9C4621099AD33EF4779B30DEC9CFC1A63D9D4847F7EDA9FE2
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................7.Yg#.......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mTj:mH
MD5:	5050E5CC1DCD2A838BEAF0F1F3D8F556
SHA1:	026DF107119A5422604E373237F7497B2E03A4CC
SHA-256:	534DEE459C22B3CA238BF204E5A66CB4314AB6E38576B0BC85B86C7F566447CE
SHA-512:	BC374D5F0C1BBBD3F82D4DD9F9FB7F9A887B5A2A247A8F17F13B5BFE2D158792FFB7792FFA2B77A0CEC32A090726B42BF7AAC9974B4F8CE2B08B2ED838272AC1
Malicious:	false
Preview:	7066.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mTF:mR
MD5:	89E4385B388D7ECB24EB9C7C816BDA60
SHA1:	23647A11FD89A7D74E85390D6B4AC2E4126B54DD
SHA-256:	5CB0E531E184391A28DBFA32CCD0D2F4EEB9740A04264837053AE6E031E75443
SHA-512:	228D48D02B2386A00F5AB2A68C6322955874D76BA6C6E1A8E4C5AD5BEBAEFFB8AA4AC5FDE98CC0E9A1DAE098610471ABD4AE9D5C49F80B9B4314B073108FCB46
Malicious:	false
Preview:	7060.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mRPVRJ:m7
MD5:	17CE0528C5CD4174F473FF281B61D877
SHA1:	68DF99CB8E4F4CE48577C8B2197806037CC5AF07
SHA-256:	827CB38E41690DC9DF24B9E0B39635CDD4143DC6D22B79791E5EAD0EBA0E0D0A
SHA-512:	51BC98CD60B3F76B4AE4E295CFE7FC6BDD4F124CCBE87909CC800AC5DE1A29A1CBBF90D0AC58685FB8646F50A9702C33AD57B431D432DFFA2753C3C86358C33A
Malicious:	false
Preview:	7043.7044.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mT2:mC
MD5:	BB36859EF40AD2F4F9B8CE45D3C16A51
SHA1:	1DA253F50BCBF42E00FDC23DB74CA7C0BDD80B25
SHA-256:	5489E7EB4E62B0ECF42E30A9DC97489B5C8F51255442A211A6F4717727476C3A
SHA-512:	BC1ABCABA4788F23D5E0E1EC555B76327B5DF7F270098FFC6FBFBCC3CFFB3BD57C05A4C5263621F2B5310CCDD9AAE3ACA3DC8FF429E39A9EEBC8C4BB72E798E9
Malicious:	false
Preview:	7061.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mTj:mH
MD5:	5050E5CC1DCD2A838BEAF0F1F3D8F556
SHA1:	026DF107119A5422604E373237F7497B2E03A4CC
SHA-256:	534DEE459C22B3CA238BF204E5A66CB4314AB6E38576B0BC85B86C7F566447CE
SHA-512:	BC374D5F0C1BBBD3F82D4DD9F9FB7F9A887B5A2A247A8F17F13B5BFE2D158792FFB7792FFA2B77A0CEC32A090726B42BF7AAC9974B4F8CE2B08B2ED838272AC1
Malicious:	false
Preview:	7066.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mTF:mR
MD5:	89E4385B388D7ECB24EB9C7C816BDA60
SHA1:	23647A11FD89A7D74E85390D6B4AC2E4126B54DD
SHA-256:	5CB0E531E184391A28DBFA32CCD0D2F4EEB9740A04264837053AE6E031E75443
SHA-512:	228D48D02B2386A00F5AB2A68C6322955874D76BA6C6E1A8E4C5AD5BEBAEFFB8AA4AC5FDE98CC0E9A1DAE098610471ABD4AE9D5C49F80B9B4314B073108FCB46
Malicious:	false
Preview:	7060.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mRPVRJ:m7
MD5:	17CE0528C5CD4174F473FF281B61D877
SHA1:	68DF99CB8E4F4CE48577C8B2197806037CC5AF07
SHA-256:	827CB38E41690DC9DF24B9E0B39635CDD4143DC6D22B79791E5EAD0EBA0E0D0A
SHA-512:	51BC98CD60B3F76B4AE4E295CFE7FC6BDD4F124CCBE87909CC800AC5DE1A29A1CBBF90D0AC58685FB8646F50A9702C33AD57B431D432DFFA2753C3C86358C33A
Malicious:	false
Preview:	7043.7044.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mT2:mC
MD5:	BB36859EF40AD2F4F9B8CE45D3C16A51
SHA1:	1DA253F50BCBF42E00FDC23DB74CA7C0BDD80B25
SHA-256:	5489E7EB4E62B0ECF42E30A9DC97489B5C8F51255442A211A6F4717727476C3A
SHA-512:	BC1ABCABA4788F23D5E0E1EC555B76327B5DF7F270098FFC6FBFBCC3CFFB3BD57C05A4C5263621F2B5310CCDD9AAE3ACA3DC8FF429E39A9EEBC8C4BB72E798E9
Malicious:	false
Preview:	7061.

/var/lib/AccountsService/users/gdm.CMVTY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.NR6NY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.TR0JY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.883678448742659
Encrypted:	false
SSDEEP:	24:QYk/ZeaEYk8YGEYk8g0Yki1YkeAvcYkeA2+VCYkYTbTKvUk/0pYrMdJrMOEQrCQU:9klk8Pk8qkLkfvJkffVPkckGYrerr5ro
MD5:	8CA8A6CD86794D48433D4EEAC1DDEEB2
SHA1:	341C4908287EB6EBDE43C5E4C15072AB91453A20
SHA-256:	E711F8AE6D3D24C55436FA9F7E56D9A6318077140E4474350CA4AB0F2E016B33
SHA-512:	DF45E12D557B384365A32CCDEFBD2C8F4AAB2367EF1ED7E37357937CCECF506C2C77B76904A592640B59EFB32027ACF1C582C6ACF5D02C00FA7B4D354811A752
Malicious:	false
Preview:	Dec 11 14:59:46 galassia systemd-logind[6910]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 11 14:59:46 galassia systemd-logind[6910]: User enumeration failed: Invalid argument.Dec 11 14:59:46 galassia systemd-logind[6910]: User of session 2 not known..Dec 11 14:59:46 galassia systemd-logind[6910]: Session enumeration failed: No such file or directory.Dec 11 14:59:46 galassia systemd-logind[6910]: Watching system buttons on /dev/input/event0 (Power Button).Dec 11 14:59:46 galassia systemd-logind[6910]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 11 14:59:46 galassia systemd-logind[6910]: New seat seat0..Dec 11 15:00:00 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 11 15:00:00 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 11 15:00:01 galassia systemd-logind[6910]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4199019569324633
Encrypted:	false
SSDEEP:	3:F31HldDHEXNDHEd/:F3Bmc/
MD5:	238022530B30B04204E42008BE9F3DC2
SHA1:	AE7C47CEFB0D3158EBA396BCC5CECD6D3E77DE46
SHA-256:	C477FD530C3021128B43B1446CEA753ED49375E6AD6C51D20BDE001C2C37FB01
SHA-512:	AE89D6830037E44574AE41C529BF773324180AB13449F98F95F9F5F1B7112699EE777814FA43AF64981C481F952A31923EBA4A5766B8C106D02B81AC03D0579D
Malicious:	false
Preview:	LPKSHHRH................K...B..C..r..................................K...B..C..r..........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4261926861171588
Encrypted:	false
SSDEEP:	3:F31Hl1oFSJhVoFSJhnl:F3Pfnl
MD5:	83E7133F616F609081A8813B5F61ECA9
SHA1:	14F498E332EFC73976A2E98C9F594FFD100F5FB4
SHA-256:	8F731439FAD7F1BF6DD493C77FF99CE8F74ABC9B19E0B757116CD85F421A13C9
SHA-512:	F428334826C17058CBAEC36B1B309AAA727C635436090C5B2AAC75F9AE89755272F8DACF3C4B6348D3CD58A9D94BC7A0CBBF54DB6E76FFCC883E81C106DED4CE
Malicious:	false
Preview:	LPKSHHRH................l.<.c.Jc. .n6 U.................................l.<.c.Jc. .n6 U.........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12555
Entropy (8bit):	4.951404172470014
Encrypted:	false
SSDEEP:	192:rFtYms34Dw13EF9r8PbUYb59ZgGwdrizEzZ:Zbw13E35AMfN
MD5:	A36ED6BA5A666F4FE0C3BAD080C4973B
SHA1:	40F603E56D1DA77EDEFBD56086181BBA7C4D3387
SHA-256:	4D2E17AD83EDE7C9A1F35FB9F99D2B4B4904A20D46E8B70ACF2206BB1B1CBCA8
SHA-512:	FA068A74D1E79FC24E9B8D8BB946F3F03441E0CCD56589045BBB32B531C05B43149F01D3C3122C12280975960AF3142F17745C463149B568D2946715C0AE0614
Malicious:	false
Preview:	Dec 11 14:59:31 galassia kernel: [ 570.826197] blocking signal 9: 6241 -> 658.Dec 11 14:59:31 galassia kernel: [ 570.831101] blocking signal 9: 6241 -> 720.Dec 11 14:59:31 galassia kernel: [ 570.835916] blocking signal 9: 6241 -> 772.Dec 11 14:59:31 galassia kernel: [ 570.843386] blocking signal 9: 6241 -> 936.Dec 11 14:59:31 galassia kernel: [ 570.847740] blocking signal 9: 6241 -> 2048.Dec 11 14:59:31 galassia kernel: [ 572.408521] New task spawned: old: (tgid 6970, tid 6970), new (tgid: 6970, tid: 6975).Dec 11 14:59:31 galassia kernel: [ 572.409514] New task spawned: old: (tgid 6970, tid 6970), new (tgid: 6970, tid: 6976).Dec 11 14:59:31 galassia kernel: [ 572.419939] New task spawned: old: (tgid 6970, tid 6976), new (tgid: 6970, tid: 6977).Dec 11 14:59:31 galassia kernel: [ 572.611950] New task spawned: old: (tgid 6974, tid 6974), new (tgid: 6978, tid: 6978).Dec 11 14:59:32 galassia kernel: [ 572.690494] New task spawned: old: (tgid 6978, tid 6978), new (tgid: 6979, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	31261
Entropy (8bit):	5.108834703918872
Encrypted:	false
SSDEEP:	768:9kt5FTn5FTn5FTtF/DM0Ieu8gSIH7J3U4605SPDhFEHLtX8wW8uygHVR:9kb5E5Kt
MD5:	BD0E352E257187E4204216123477C6DE
SHA1:	651106C36B0EEC9AC15D624A6DEA1205FFD35F89
SHA-256:	5F1DCD3A27E5D6FB85D6A9C52AF70EA3F35B258C3C893AA3E48E0FEB55DB4259
SHA-512:	4A5AED9E73C03C62FC9E13D273A1A7F323E661ECDF513B63857D285459091D9A69B91E232A9CBB3A8B7D33300C3A6A653CC3B3F0B70FE62C5482D41FFBDF92CF
Malicious:	false
Preview:	Dec 11 14:59:31 galassia kernel: [ 570.775320] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 11 14:59:31 galassia kernel: [ 570.775410] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 11 14:59:31 galassia kernel: [ 570.789915] systemd[1]: rtkit-daemon.service: Succeeded..Dec 11 14:59:31 galassia kernel: [ 570.803001] systemd[1]: whoopsie.service: Scheduled restart job, restart counter is at 5..Dec 11 14:59:31 galassia kernel: [ 570.803022] systemd[1]: Stopped crash report submission daemon..Dec 11 14:59:31 galassia kernel: [ 570.803879] systemd[1]: Started crash report submission daemon..Dec 11 14:59:31 galassia kernel: [ 570.804228] systemd[1]: accounts-daemon.service: Succeeded..Dec 11 14:59:31 galassia kernel: [ 570.826197] blocking signal 9: 6241 -> 658.Dec 11 14:59:31 galassia kernel: [ 570.831101] blocking signal 9: 6241 -> 720.Dec 11 14:59:31 galassia kernel: [ 570.835916] blocking signal 9: 6241 -> 772.Dec 11 14:59:31 g

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:fRc1sXlXEWtl/4Rtl/:fRv+ylutl
MD5:	8A1C80B37A9F8F3D8E31FC96B7B66534
SHA1:	30D3A70BE1E9C49F76318AB3A4FC1C500AE852A3
SHA-256:	E55D3CFBC27C5D15A5C1E23A0896139B6714C828914459F6F68D74E7622420EF
SHA-512:	3E9F550AF70958A79C512EB766B1CF15BA15454D7735F4B8731B51F7C9638AF0C3A3043635771AD9C4621099AD33EF4779B30DEC9CFC1A63D9D4847F7EDA9FE2
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN...................................................................................................................................................................................................................................................................................................7.Yg#.......................................

Source: global traffic	TCP traffic: 192.168.2.23:50020 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:52678 -> 178.215.238.4:33966

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.41482451387805
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	dwhdbg.elf
File size:	172'264 bytes
MD5:	e90fe2a6dd20cd7cca1f438595fe3906
SHA1:	5775adb8b1cc52ba68c78a2bbf71e5df0eac0329
SHA256:	e269623e4ffc0248a8d272b2b7956d60d291739a6d0c351587a7952f4c6cea15
SHA512:	224ed7728ae59e7a50af518171773bb2045e27990467c98401cf45ef22850b7cf995b6e4d20168eb8e4ec56b3d8032c0765ab642f1189f7e14599f660ed9f79e
SSDEEP:	3072:mPggUlLwIKjKOzPHlyHEXGXJXewzZEvCL2AWaC/Cnm0oFeMPm/lM:mIgUlLwIKNzPHlqEXGXo3U3ouM
TLSH:	6EF35B17B5C1C4FDC4CAC0744BAEE637E972F19E0238B25B17D4AA222E4DE305B5DA94
File Content Preview:	.ELF..............>.......@.....@.......h...........@.8...@.......................@.......@...............................................R.......R.....(.......@...............Q.td....................................................H...._........H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	171624
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x1c2b6	0x0	0x6	AX	16
.fini	PROGBITS	0x41c3b6	0x1c3b6	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x41c3e0	0x1c3e0	0x44c0	0x0	0x2	A	32
.ctors	PROGBITS	0x521000	0x21000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x521018	0x21018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x521040	0x21040	0x8de8	0x0	0x3	WA	32
.bss	NOBITS	0x529e40	0x29e28	0x7100	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x29e28	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x208a0	0x208a0	6.3939	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x21000	0x521000	0x521000	0x8e28	0xff40	0.2385	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 11, 2024 21:56:56.382164001 CET	42112	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:56:56.770917892 CET	53	42112	8.8.8.8	192.168.2.23
Dec 11, 2024 21:56:56.788167000 CET	43384	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:56:57.187232971 CET	53	43384	8.8.8.8	192.168.2.23
Dec 11, 2024 21:56:58.597340107 CET	41037	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:56:58.734081030 CET	53	41037	8.8.8.8	192.168.2.23
Dec 11, 2024 21:56:58.738359928 CET	34749	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:56:58.873523951 CET	53	34749	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:00.270240068 CET	33405	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:00.668764114 CET	53	33405	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:00.670015097 CET	50269	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:00.804899931 CET	53	50269	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:02.232944965 CET	45949	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:02.633824110 CET	53	45949	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:02.635616064 CET	47812	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:02.771169901 CET	53	47812	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:04.158771992 CET	52851	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:04.292464018 CET	53	52851	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:04.293459892 CET	58111	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:04.431273937 CET	53	58111	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:05.828809023 CET	55258	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:06.214116096 CET	53	55258	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:06.215703011 CET	49307	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:06.350023031 CET	53	49307	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:07.742764950 CET	44629	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:07.876902103 CET	53	44629	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:07.878024101 CET	40193	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:08.015531063 CET	53	40193	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:09.404119968 CET	41660	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:09.538289070 CET	53	41660	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:09.539397955 CET	36757	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:09.673360109 CET	53	36757	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:11.061316013 CET	45625	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:11.195580959 CET	53	45625	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:11.196752071 CET	41878	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:11.330660105 CET	53	41878	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:12.728130102 CET	58147	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:12.863461971 CET	53	58147	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:12.864409924 CET	34271	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:12.999253988 CET	53	34271	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:14.385065079 CET	33966	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:14.750680923 CET	53	33966	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:14.751610994 CET	33214	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:14.885413885 CET	53	33214	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:16.274698019 CET	36652	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:16.408889055 CET	53	36652	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:16.410011053 CET	57466	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:16.532550097 CET	53	57466	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:17.921406031 CET	33636	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:18.055474997 CET	53	33636	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:18.056914091 CET	55035	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:18.190756083 CET	53	55035	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:19.578663111 CET	55006	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:19.713143110 CET	53	55006	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:19.714046955 CET	49747	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:20.139556885 CET	53	49747	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:21.528964043 CET	49393	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:21.663494110 CET	53	49393	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:21.664777994 CET	42821	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:21.799072027 CET	53	42821	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:23.192701101 CET	34484	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:23.328152895 CET	53	34484	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:23.329731941 CET	54005	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:23.468691111 CET	53	54005	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:24.859867096 CET	54576	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:24.993741035 CET	53	54576	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:24.995779037 CET	56082	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:25.129803896 CET	53	56082	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:26.517163992 CET	36673	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:26.650705099 CET	53	36673	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:26.651702881 CET	38199	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:26.774668932 CET	53	38199	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:28.166877031 CET	35763	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:28.290941000 CET	53	35763	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:28.292676926 CET	56339	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:28.427210093 CET	53	56339	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:29.867611885 CET	34261	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:30.001461029 CET	53	34261	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:30.002953053 CET	50727	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:30.137547016 CET	53	50727	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:31.528361082 CET	38420	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:31.650540113 CET	53	38420	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:31.652301073 CET	60945	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:31.774956942 CET	53	60945	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:33.175499916 CET	49464	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:33.298033953 CET	53	49464	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:33.299820900 CET	42375	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:33.434004068 CET	53	42375	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:34.822361946 CET	39212	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:34.956370115 CET	53	39212	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:34.959408998 CET	49310	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:35.093875885 CET	53	49310	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:36.489641905 CET	59984	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:36.624295950 CET	53	59984	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:36.627814054 CET	35566	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:36.750447035 CET	53	35566	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:38.142443895 CET	56118	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:38.276873112 CET	53	56118	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:38.279175997 CET	45518	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:38.643527985 CET	53	45518	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:40.090732098 CET	42971	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:40.224494934 CET	53	42971	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:40.251004934 CET	36299	53	192.168.2.23	8.8.8.8
Dec 11, 2024 21:57:40.389322042 CET	53	36299	8.8.8.8	192.168.2.23
Dec 11, 2024 21:57:47.374582052 CET	54394	53	192.168.2.23	1.1.1.1
Dec 11, 2024 21:57:47.374619961 CET	38931	53	192.168.2.23	1.1.1.1
Dec 11, 2024 21:57:47.597681999 CET	53	38931	1.1.1.1	192.168.2.23
Dec 11, 2024 21:57:47.603095055 CET	53	54394	1.1.1.1	192.168.2.23
Dec 11, 2024 21:57:48.189340115 CET	57303	53	192.168.2.23	1.1.1.1
Dec 11, 2024 21:57:48.326518059 CET	53	57303	1.1.1.1	192.168.2.23
Dec 11, 2024 21:58:13.375523090 CET	58741	53	192.168.2.23	1.1.1.1
Dec 11, 2024 21:58:13.513370037 CET	53	58741	1.1.1.1	192.168.2.23
Dec 11, 2024 21:58:31.268001080 CET	49944	53	192.168.2.23	1.1.1.1
Dec 11, 2024 21:58:31.406663895 CET	53	49944	1.1.1.1	192.168.2.23
Dec 11, 2024 21:59:34.740292072 CET	58380	53	192.168.2.23	1.1.1.1
Dec 11, 2024 21:59:34.740350008 CET	56830	53	192.168.2.23	1.1.1.1
Dec 11, 2024 21:59:34.880083084 CET	53	56830	1.1.1.1	192.168.2.23
Dec 11, 2024 21:59:34.970546961 CET	53	58380	1.1.1.1	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 11, 2024 21:58:05.784900904 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 11, 2024 21:59:25.804701090 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-11 20:57:54 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-11 20:57:55 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-11 20:57:55 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-11 20:57:56 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Dec 2024 20:57:56 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	20:56:55
Start date (UTC):	11/12/2024
Path:	/tmp/dwhdbg.elf
Arguments:	/tmp/dwhdbg.elf
File size:	172264 bytes
MD5 hash:	e90fe2a6dd20cd7cca1f438595fe3906

Start time (UTC):	20:56:57
Start date (UTC):	11/12/2024
Path:	/tmp/dwhdbg.elf
Arguments:	-
File size:	172264 bytes
MD5 hash:	e90fe2a6dd20cd7cca1f438595fe3906

Start time (UTC):	20:58:30
Start date (UTC):	11/12/2024
Path:	/tmp/dwhdbg.elf
Arguments:	-
File size:	172264 bytes
MD5 hash:	e90fe2a6dd20cd7cca1f438595fe3906

Start time (UTC):	20:56:56
Start date (UTC):	11/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	20:57:38
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:40
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:43
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:44
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:45
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:46
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:47
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:48
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report dwhdbg.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6638/oom_score_adj

/proc/6877/oom_score_adj

/proc/7052/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:150969670wnz9

/run/systemd/journal/streams/.#9:1509697KoWrW8

/run/systemd/journal/streams/.#9:1509791auV7Ca

/run/systemd/journal/streams/.#9:1509792xlwoNb

/run/systemd/journal/streams/.#9:1509794ElN0nb

/run/systemd/journal/streams/.#9:1509795VaGRfb

/run/systemd/journal/streams/.#9:1509801EM4Pq9

/run/systemd/journal/streams/.#9:1509815QAlEkc

/run/systemd/journal/streams/.#9:15098169cgTac

/run/systemd/journal/streams/.#9:1509822vPURPb

/run/systemd/journal/streams/.#9:15098238GE0z9

/run/systemd/journal/streams/.#9:150982475lAA9

/run/systemd/journal/streams/.#9:1509825YavqT7

/run/systemd/journal/streams/.#9:15098265uOEFb

/run/systemd/journal/streams/.#9:1509934gFIVEa

/run/systemd/journal/streams/.#9:1510041MQUITa

/run/systemd/journal/streams/.#9:1510104cuXc57

/run/systemd/journal/streams/.#9:1510106lNEhrb

Linux Analysis Report
dwhdbg.elf

Start time (UTC):	20:57:49
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:57:50
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:57:51
Start date (UTC):	11/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:57:52
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:57:54
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:57:55
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:58:04
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:58:05
Start date (UTC):	11/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:58:06
Start date (UTC):	11/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:58:08
Start date (UTC):	11/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a