Edit tour

Linux Analysis Report
vwkjebwi686.elf

Overview

General Information

Sample name:	vwkjebwi686.elf
Analysis ID:	1573375
MD5:	b8fd0206e3798742e76dbed9bc97c57c
SHA1:	489746eb51ff7df99090f11566bb739902d6d3c3
SHA256:	75df4b4cd3628d5e1eb4360fdb28446d3922f68cab867567352a55d37072c32c
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1573375
Start date and time:	2024-12-11 22:11:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 14s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	vwkjebwi686.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/156@109/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: vwkjebwi686.elf

Runtime Messages

Command:	/tmp/vwkjebwi686.elf
PID:	6220
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

vwkjebwi686.elf (PID: 6220, Parent: 6136, MD5: b8fd0206e3798742e76dbed9bc97c57c) Arguments: /tmp/vwkjebwi686.elf

vwkjebwi686.elf New Fork (PID: 6221, Parent: 6220)

vwkjebwi686.elf New Fork (PID: 6222, Parent: 6221)

vwkjebwi686.elf New Fork (PID: 6380, Parent: 6222)

sh (PID: 6380, Parent: 6222, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6381, Parent: 6380)

ps (PID: 6381, Parent: 6380, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

vwkjebwi686.elf New Fork (PID: 6874, Parent: 6222)

sh (PID: 6874, Parent: 6222, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6876, Parent: 6874)

ps (PID: 6876, Parent: 6874, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6223, Parent: 1477)

sh (PID: 6223, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6223, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6228, Parent: 1)

systemd-hostnamed (PID: 6228, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6334, Parent: 1320)

Default (PID: 6334, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6353, Parent: 1320)

Default (PID: 6353, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6433, Parent: 1)

journalctl (PID: 6433, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6447, Parent: 1)

systemd-journald (PID: 6447, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6452, Parent: 1)

journalctl (PID: 6452, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6463, Parent: 1)

dbus-daemon (PID: 6463, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6468, Parent: 1320)

Default (PID: 6468, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6472, Parent: 1860)

pulseaudio (PID: 6472, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6474, Parent: 1)

rsyslogd (PID: 6474, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6481, Parent: 1)

rtkit-daemon (PID: 6481, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6484, Parent: 1)

systemd-logind (PID: 6484, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6546, Parent: 1)

polkitd (PID: 6546, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6550, Parent: 1)

gpu-manager (PID: 6550, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6551, Parent: 6550)

sh (PID: 6551, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6553, Parent: 6551)

grep (PID: 6553, Parent: 6551, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6555, Parent: 6550)

sh (PID: 6555, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6556, Parent: 6555)

grep (PID: 6556, Parent: 6555, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6557, Parent: 6550)

sh (PID: 6557, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6558, Parent: 6557)

grep (PID: 6558, Parent: 6557, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6559, Parent: 6550)

sh (PID: 6559, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6560, Parent: 6559)

grep (PID: 6560, Parent: 6559, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6561, Parent: 6550)

sh (PID: 6561, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6562, Parent: 6561)

grep (PID: 6562, Parent: 6561, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6563, Parent: 6550)

sh (PID: 6563, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6564, Parent: 6563)

grep (PID: 6564, Parent: 6563, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6565, Parent: 6550)

sh (PID: 6565, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6566, Parent: 6565)

grep (PID: 6566, Parent: 6565, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6567, Parent: 6550)

sh (PID: 6567, Parent: 6550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6570, Parent: 6567)

grep (PID: 6570, Parent: 6567, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6554, Parent: 1)

agetty (PID: 6554, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gvfsd-fuse New Fork (PID: 6571, Parent: 2038)

fusermount (PID: 6571, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6577, Parent: 1)

generate-config (PID: 6577, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6578, Parent: 6577)

pkill (PID: 6578, Parent: 6577, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6579, Parent: 1)

gdm-wait-for-drm (PID: 6579, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6585, Parent: 1)

gdm3 (PID: 6585, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6588, Parent: 6585)

plymouth (PID: 6588, Parent: 6585, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6598, Parent: 6585)

gdm-session-worker (PID: 6598, Parent: 6585, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6604, Parent: 6598)

gdm-wayland-session (PID: 6604, Parent: 6598, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6606, Parent: 6604)

dbus-daemon (PID: 6606, Parent: 6604, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

gdm-wayland-session New Fork (PID: 6609, Parent: 6604)

gdm3 New Fork (PID: 6608, Parent: 6585)

Default (PID: 6608, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6611, Parent: 6585)

Default (PID: 6611, Parent: 6585, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6589, Parent: 1)

accounts-daemon (PID: 6589, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6593, Parent: 6589)

language-validate (PID: 6593, Parent: 6589, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6594, Parent: 6593)

language-options (PID: 6594, Parent: 6593, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6595, Parent: 6594)

sh (PID: 6595, Parent: 6594, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6596, Parent: 6595)

locale (PID: 6596, Parent: 6595, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6597, Parent: 6595)

grep (PID: 6597, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6612, Parent: 1)

rsyslogd (PID: 6612, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6613, Parent: 1)

agetty (PID: 6613, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6620, Parent: 1)

gpu-manager (PID: 6620, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6623, Parent: 6620)

sh (PID: 6623, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6624, Parent: 6623)

grep (PID: 6624, Parent: 6623, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6625, Parent: 6620)

sh (PID: 6625, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6626, Parent: 6625)

grep (PID: 6626, Parent: 6625, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6627, Parent: 6620)

sh (PID: 6627, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6628, Parent: 6627)

grep (PID: 6628, Parent: 6627, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6629, Parent: 6620)

sh (PID: 6629, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6630, Parent: 6629)

grep (PID: 6630, Parent: 6629, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6631, Parent: 6620)

sh (PID: 6631, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6632, Parent: 6631)

grep (PID: 6632, Parent: 6631, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6633, Parent: 6620)

sh (PID: 6633, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6634, Parent: 6633)

grep (PID: 6634, Parent: 6633, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6698, Parent: 6620)

sh (PID: 6698, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6699, Parent: 6698)

grep (PID: 6699, Parent: 6698, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6701, Parent: 6620)

sh (PID: 6701, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6702, Parent: 6701)

grep (PID: 6702, Parent: 6701, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6622, Parent: 1)

dbus-daemon (PID: 6622, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6640, Parent: 1)

systemd-logind (PID: 6640, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6703, Parent: 1)

generate-config (PID: 6703, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6704, Parent: 6703)

pkill (PID: 6704, Parent: 6703, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6705, Parent: 1)

gdm-wait-for-drm (PID: 6705, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6709, Parent: 1)

rsyslogd (PID: 6709, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6714, Parent: 1)

dbus-daemon (PID: 6714, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6719, Parent: 1)

rsyslogd (PID: 6719, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6726, Parent: 1)

systemd-logind (PID: 6726, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6784, Parent: 1)

journalctl (PID: 6784, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6785, Parent: 1)

systemd-journald (PID: 6785, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6787, Parent: 1)

dbus-daemon (PID: 6787, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6788, Parent: 1)

agetty (PID: 6788, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6789, Parent: 1)

rsyslogd (PID: 6789, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6792, Parent: 1)

systemd-logind (PID: 6792, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6849, Parent: 1)

systemd-journald (PID: 6849, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6851, Parent: 1)

gpu-manager (PID: 6851, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6856, Parent: 6851)

sh (PID: 6856, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6857, Parent: 6856)

grep (PID: 6857, Parent: 6856, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6860, Parent: 6851)

sh (PID: 6860, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6861, Parent: 6860)

grep (PID: 6861, Parent: 6860, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6863, Parent: 6851)

sh (PID: 6863, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6864, Parent: 6863)

grep (PID: 6864, Parent: 6863, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6866, Parent: 6851)

sh (PID: 6866, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6868, Parent: 6866)

grep (PID: 6868, Parent: 6866, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6869, Parent: 6851)

sh (PID: 6869, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6871, Parent: 6869)

grep (PID: 6871, Parent: 6869, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6872, Parent: 6851)

sh (PID: 6872, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6873, Parent: 6872)

grep (PID: 6873, Parent: 6872, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6875, Parent: 6851)

sh (PID: 6875, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6877, Parent: 6875)

grep (PID: 6877, Parent: 6875, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6878, Parent: 6851)

sh (PID: 6878, Parent: 6851, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6879, Parent: 6878)

grep (PID: 6879, Parent: 6878, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6880, Parent: 1)

generate-config (PID: 6880, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6881, Parent: 6880)

pkill (PID: 6881, Parent: 6880, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6884, Parent: 1)

gdm-wait-for-drm (PID: 6884, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6889, Parent: 1)

gdm3 (PID: 6889, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6892, Parent: 6889)

plymouth (PID: 6892, Parent: 6889, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6906, Parent: 6889)

gdm-session-worker (PID: 6906, Parent: 6889, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6912, Parent: 6906)

gdm-wayland-session (PID: 6912, Parent: 6906, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6914, Parent: 6912)

dbus-daemon (PID: 6914, Parent: 6912, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6916, Parent: 6914)

dbus-daemon New Fork (PID: 6917, Parent: 6916)

false (PID: 6917, Parent: 6916, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6918, Parent: 6912)

dbus-run-session (PID: 6918, Parent: 6912, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6919, Parent: 6918)

dbus-daemon (PID: 6919, Parent: 6918, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6920, Parent: 6889)

Default (PID: 6920, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6921, Parent: 6889)

Default (PID: 6921, Parent: 6889, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6893, Parent: 1)

accounts-daemon (PID: 6893, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6897, Parent: 6893)

language-validate (PID: 6897, Parent: 6893, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6898, Parent: 6897)

language-options (PID: 6898, Parent: 6897, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6899, Parent: 6898)

sh (PID: 6899, Parent: 6898, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6900, Parent: 6899)

locale (PID: 6900, Parent: 6899, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6901, Parent: 6899)

grep (PID: 6901, Parent: 6899, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6902, Parent: 1)

polkitd (PID: 6902, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6937, Parent: 1860)

dbus-daemon (PID: 6937, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6938, Parent: 1860)

pulseaudio (PID: 6938, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6939, Parent: 1)

rtkit-daemon (PID: 6939, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6942, Parent: 1)

dbus-daemon (PID: 6942, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6943, Parent: 1)

agetty (PID: 6943, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6944, Parent: 1)

systemd-journald (PID: 6944, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6947, Parent: 1)

systemd-logind (PID: 6947, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7004, Parent: 1)

rsyslogd (PID: 7004, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7006, Parent: 1)

dbus-daemon (PID: 7006, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7007, Parent: 1)

agetty (PID: 7007, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7008, Parent: 1)

rsyslogd (PID: 7008, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7013, Parent: 1)

gpu-manager (PID: 7013, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7014, Parent: 7013)

sh (PID: 7014, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7015, Parent: 7014)

grep (PID: 7015, Parent: 7014, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7016, Parent: 7013)

sh (PID: 7016, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7017, Parent: 7016)

grep (PID: 7017, Parent: 7016, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7019, Parent: 7013)

sh (PID: 7019, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7020, Parent: 7019)

grep (PID: 7020, Parent: 7019, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7022, Parent: 7013)

sh (PID: 7022, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7023, Parent: 7022)

grep (PID: 7023, Parent: 7022, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7027, Parent: 7013)

sh (PID: 7027, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7028, Parent: 7027)

grep (PID: 7028, Parent: 7027, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7029, Parent: 7013)

sh (PID: 7029, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7030, Parent: 7029)

grep (PID: 7030, Parent: 7029, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7031, Parent: 7013)

sh (PID: 7031, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7032, Parent: 7031)

grep (PID: 7032, Parent: 7031, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7033, Parent: 7013)

sh (PID: 7033, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7034, Parent: 7033)

grep (PID: 7034, Parent: 7033, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7035, Parent: 1)

generate-config (PID: 7035, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7036, Parent: 7035)

pkill (PID: 7036, Parent: 7035, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7039, Parent: 1)

gdm-wait-for-drm (PID: 7039, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7044, Parent: 1)

gdm3 (PID: 7044, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7047, Parent: 7044)

plymouth (PID: 7047, Parent: 7044, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7061, Parent: 7044)

gdm-session-worker (PID: 7061, Parent: 7044, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7069, Parent: 7061)

gdm-wayland-session (PID: 7069, Parent: 7061, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7071, Parent: 7069)

dbus-daemon (PID: 7071, Parent: 7069, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7075, Parent: 7071)

dbus-daemon New Fork (PID: 7076, Parent: 7075)

false (PID: 7076, Parent: 7075, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7077, Parent: 7069)

dbus-run-session (PID: 7077, Parent: 7069, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7078, Parent: 7077)

dbus-daemon (PID: 7078, Parent: 7077, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7080, Parent: 7044)

Default (PID: 7080, Parent: 7044, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7081, Parent: 7044)

Default (PID: 7081, Parent: 7044, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7048, Parent: 1)

accounts-daemon (PID: 7048, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7052, Parent: 7048)

language-validate (PID: 7052, Parent: 7048, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7053, Parent: 7052)

language-options (PID: 7053, Parent: 7052, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7054, Parent: 7053)

sh (PID: 7054, Parent: 7053, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7055, Parent: 7054)

locale (PID: 7055, Parent: 7054, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7056, Parent: 7054)

grep (PID: 7056, Parent: 7054, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7057, Parent: 1)

polkitd (PID: 7057, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7067, Parent: 1)

systemd (PID: 7067, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7072, Parent: 7067)

systemd New Fork (PID: 7073, Parent: 7072)

30-systemd-environment-d-generator (PID: 7073, Parent: 7072, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7082, Parent: 7067)

systemctl (PID: 7082, Parent: 7067, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7085, Parent: 7067)

pulseaudio (PID: 7085, Parent: 7067, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7091, Parent: 7067)

dbus-daemon (PID: 7091, Parent: 7067, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7086, Parent: 1)

rtkit-daemon (PID: 7086, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
vwkjebwi686.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
vwkjebwi686.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1739c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
vwkjebwi686.elf	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x7a6f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
vwkjebwi686.elf	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x7a22:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
vwkjebwi686.elf	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0xa52d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0xa5cd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
vwkjebwi686.elf	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
vwkjebwi686.elf	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xabc2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
vwkjebwi686.elf	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xff2e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6220.1.0000000008048000.0000000008062000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6220.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x17270:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17284:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17298:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172ac:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172c0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172d4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172e8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x172fc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17310:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17324:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17338:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1734c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17360:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17374:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17388:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1739c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173b0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173c4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173d8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x173ec:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x17400:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6220.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_268aac0b	unknown	unknown	0x7a6f:$a: 24 18 0F B7 44 24 20 8B 54 24 1C 83 F9 01 8B 7E 0C 89 04 24 8B
6220.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_0cb1699c	unknown	unknown	0x7a22:$a: DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 10 0F B7 02 83 E9 02 83
6220.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_70ef58f1	unknown	unknown	0xa52d:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C 0xa5cd:$a: 89 D0 8B 19 01 D8 0F B6 5C 24 10 30 18 89 D0 8B 19 01 D8 0F B6 5C
6220.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_2e3f67a9	unknown	unknown	0x582:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44 0x5e2:$a: 53 83 EC 04 0F B6 74 24 14 8B 5C 24 18 8B 7C 24 20 0F B6 44
6220.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0xabc2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6220.1.0000000008048000.0000000008062000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xff2e:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
Process Memory Space: vwkjebwi686.elf PID: 6220	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: vwkjebwi686.elf PID: 6220	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa7f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xa93:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaa7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xabb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xacf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xae3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaf7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb0b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb1f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb33:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb47:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb5b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb6f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb83:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb97:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbbf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbd3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbe7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbfb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc0f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 5 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6474)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6612)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6709)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6719)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6789)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 7008)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6447)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6585)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6606)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6785)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6849)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6889)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6914)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6944)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7044)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7071)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7078)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7067)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.194.dr, syslog.182.dr, syslog.43.dr, syslog.126.dr, syslog.303.dr, syslog.176.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53828
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b Author: unknown
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c Author: unknown
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 Author: unknown
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 Author: unknown
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: Process Memory Space: vwkjebwi686.elf PID: 6220, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4469, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4473, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4501, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6170, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6349, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6350, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6351, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6352, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6380, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6381, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6463, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6554, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6585, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6610, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6612, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6619, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6622, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6708, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6708, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6447, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6705, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6713, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6714, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6715, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6719, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6786, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6196, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6197, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6428, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6472, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6787, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6788, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6789, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6849, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6852, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6874, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6876, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6889, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6937, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6938, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6942, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6943, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 7004, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4448, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4469, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4473, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4478, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 4501, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6047, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6166, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6170, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6349, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6350, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6351, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6352, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6380, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6381, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6463, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6474, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6554, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6585, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6610, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6612, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6613, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6619, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6622, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6708, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6708, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6709, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6447, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6705, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6713, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6714, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6715, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6719, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6785, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6786, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6196, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6197, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6428, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6472, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6614, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6615, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6787, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6788, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6789, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6792, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6849, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6852, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6874, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6876, result: no such process	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6889, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6937, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6938, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6942, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 6943, result: successful	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6222)	SIGKILL sent: pid: 7004, result: successful	Jump to behavior

Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: vwkjebwi686.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_268aac0b reference_sample = 49c94d184d7e387c3efe34ae6f021e011c3046ae631c9733ab0a230d5fe28ead, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 9c581721bf82af7dc6482a2c41af5fb3404e01c82545c7b2b29230f707014781, id = 268aac0b-c5c7-4035-8381-4e182de91e32, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_0cb1699c reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6e44c68bba8c9fb53ac85080b9ad765579f027cabfea5055a0bb3a85b8671089, id = 0cb1699c-9a08-4885-aa7f-0f1ee2543cac, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_70ef58f1 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c46eac9185e5f396456004d1e0c42b54a9318e0450f797c55703122cfb8fea89, id = 70ef58f1-ac74-4e33-ae03-e68d1d5a4379, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_2e3f67a9 reference_sample = fc8741f67f39e7409ab2c6c62d4f9acdd168d3e53cf6976dd87501833771cacb, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 6a06815f3d2e5f1a7a67f4264953dbb2e9d14e5f3486b178da845eab5b922d4f, id = 2e3f67a9-6fd5-4457-a626-3a9015bdb401, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: Process Memory Space: vwkjebwi686.elf PID: 6220, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/156@109/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6463)	File: /proc/6463/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6571)	File: /proc/6571/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6606)	File: /proc/6606/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6622)	File: /proc/6622/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6714)	File: /proc/6714/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6787)	File: /proc/6787/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6914)	File: /proc/6914/mounts
Source: /usr/bin/dbus-daemon (PID: 6937)	File: /proc/6937/mounts
Source: /usr/bin/dbus-daemon (PID: 7006)	File: /proc/7006/mounts
Source: /usr/bin/dbus-daemon (PID: 7071)	File: /proc/7071/mounts
Source: /usr/bin/dbus-daemon (PID: 7078)	File: /proc/7078/mounts
Source: /usr/bin/dbus-daemon (PID: 7091)	File: /proc/7091/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6223)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6223)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6228)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:75444cLFyfI	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:75445pDZDWE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:75740KGmXSE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:757466fH7nF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:75753IpDWzG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:76641D7UZNE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:76642gwFOnH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:767572gAnKE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77152T5yGwI	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77215Bv1TOI	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77308Utw8XF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77325nxEu6E	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77408f2cthF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:775054oWywG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77535xYTF3I	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77536IHzTwF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77565CMohdF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77566AvFBmF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77619rQ5JmG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77715X6fNkF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77729ZfXTCG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77747Lac4vG	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77785JjUsVH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:77808GY1XLF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:79094zybCKH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:79265c7YNfH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:79266fFhaUH	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File: /run/systemd/journal/streams/.#9:79464WGw25E	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	File: /run/systemd/seats/.#seat0v0Dzzt	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	File: /run/systemd/users/.#127f3IVLs	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	File: /run/systemd/users/.#127kCTAbt	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	File: /run/systemd/seats/.#seat08seDiw	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	File: /run/systemd/users/.#1271tKBBt	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6484)	File: /run/systemd/users/.#127eD5wCt	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6546)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6604)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6589)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6589)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6640)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6640)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6640)	File: /run/systemd/seats/.#seat0BgXfWj	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6726)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6726)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6726)	File: /run/systemd/seats/.#seat01ksI5O	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/seats/.#seat02FJ3vO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#127frA2CK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#12732eTsM	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/seats/.#seat0RHKRPN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#127w4QiRN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#1275MrukL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6792)	File: /run/systemd/users/.#127z4YMCN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80473LTjSM4
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80481FMk4p5
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:8048207sFy3
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80494nCRz34
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:804956L9E45
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80496gdtFK4
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:805046X0Qx5
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80506t4dYl3
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80597XJJMY6
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80619N1oEU4
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80631pfm4j6
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80654hwCv96
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80655GnrOT5
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80704EDxj03
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:80705f8KQZ4
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:81830AvspL4
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:818786GDtD7
Source: /lib/systemd/systemd-journald (PID: 6849)	File: /run/systemd/journal/streams/.#9:83010EReJp4
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6912)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6893)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6893)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6902)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666070qFXYIg
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666071K2ESxi
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666072Qi4iQe
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666073BBoAVh
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666080SZ2Hvf
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666089nJwi3i
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666186in2Cci
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666265rHMqSg
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666365i86Mtf
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666471xNaI1e
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:666517XGjcag
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:6665195PMvNh
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:4089886SIkrci
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:4089899E74aZi
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:4089901HSc7Ji
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:4090083WH1qAf
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:4090131tT7tKf
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:4090239frJQLi
Source: /lib/systemd/systemd-journald (PID: 6944)	File: /run/systemd/journal/streams/.#9:4090379doNjtf
Source: /lib/systemd/systemd-logind (PID: 6947)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6947)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/seats/.#seat0gxCHOw
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/users/.#127UlWmEu
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/users/.#1274HZEww
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/seats/.#seat055IT3v
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/users/.#12721sI7v
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/users/.#127IifPZv
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/users/.#127NbZSAu
Source: /lib/systemd/systemd-logind (PID: 6947)	File: /run/systemd/users/.#1277ehBXw
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7069)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7057)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7067)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7073)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7067/status
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7091/stat
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7082/comm
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7082/cgroup
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7072/comm
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/7085/stat
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/environ
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/sched
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/cgroup
Source: /lib/systemd/systemd (PID: 7067)	File opened: /proc/1/comm
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7044/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7057/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7067/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7048/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7069/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7006/status
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7006/attr/current
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7005/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7005/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7061/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7061/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7086/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7085/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7085/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/7085/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/1/cmdline
Source: /usr/bin/dbus-daemon (PID: 7006)	File opened: /proc/6947/cmdline
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6472/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6472/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6472/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6472/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6472/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6472/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6472/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6471/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6474/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6474/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6474/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6474/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6474/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6474/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6474/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6598/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6598/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6598/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6598/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6598/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6598/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/6598/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	File opened: /proc/2028/cgroup	Jump to behavior

Source: /tmp/vwkjebwi686.elf (PID: 6380)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/vwkjebwi686.elf (PID: 6874)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6551)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6555)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6557)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6559)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6561)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6563)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6565)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6567)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6595)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6623)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6625)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6627)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6629)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6631)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6633)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6698)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6701)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6856)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6860)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6863)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6866)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6869)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6872)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6875)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6878)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6899)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7014)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7016)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7019)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7022)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7027)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7029)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7031)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7033)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7054)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6553)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6556)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6558)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6560)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6562)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6564)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6566)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6570)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6597)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6624)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6626)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6628)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6630)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6632)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6634)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6699)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6702)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6857)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6861)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6864)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6868)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6873)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6877)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6879)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6901)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7015)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7017)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7020)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7023)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7028)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7030)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7032)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7034)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7056)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6578)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6704)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6881)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7036)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6381)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6876)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7082)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6381)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6876)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6785)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6849)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6944)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6554)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6613)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6788)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 7007)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6585)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6585)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6589)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6589)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6889)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6889)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6893)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6893)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7044)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7044)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6474)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6474)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6550)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6612)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6612)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6620)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6709)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6719)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6719)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6789)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6789)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6851)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7008)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7008)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7013)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/vwkjebwi686.elf (PID: 6221)

File: /tmp/vwkjebwi686.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6550)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6620)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6851)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7013)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6381)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6876)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6472)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6578)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6704)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6881)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7036)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7085)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-hostnamed (PID: 6228)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6447)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6472)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6474)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6550)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6554)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6598)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6612)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6613)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6620)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6709)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6719)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6785)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6788)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6789)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6849)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6851)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6906)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6944)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7007)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7008)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7013)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7061)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7085)	Queries kernel information via 'uname':

Source: syslog.303.dr	Binary or memory string: Dec 11 15:14:38 galassia kernel: [ 584.101915] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: kern.log.43.dr	Binary or memory string: Dec 11 15:12:54 galassia kernel: [ 480.409583] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: syslog.303.dr	Binary or memory string: Dec 11 15:14:38 galassia kernel: [ 584.101896] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.43.dr	Binary or memory string: Dec 11 15:12:54 galassia kernel: [ 480.409606] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6589)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6893)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7048)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 6220, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: vwkjebwi686.elf, type: SAMPLE
Source: Yara match	File source: 6220.1.0000000008048000.0000000008062000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vwkjebwi686.elf PID: 6220, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
vwkjebwi686.elf	100%	Avira	EXP/ELF.Mirai.Z.A
vwkjebwi686.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
raw.cardiacpure.ru	178.215.238.4	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.194.dr, syslog.182.dr, syslog.43.dr, syslog.126.dr, syslog.303.dr, syslog.176.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.4	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
178.215.238.4	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	dwhdbg.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.ppc.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	qkehusl.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	kjsusa6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	atlas.sparc.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	la.bot.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
raw.cardiacpure.ru	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	vkjqpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wriww68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vsbeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	RH74mYjwoQ.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	wriww68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	atlas.sparc.elf	Get hash	malicious	Unknown	Browse	178.215.238.31
INIT7CH	dwhdbg.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_arm6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	main_sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	.i.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	qkehusl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
CANONICAL-ASGB	dwhdbg.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_arm6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	main_x86_64.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	boatnet.sh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.arm6.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	.i.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6917/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/7076/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mRJ:mf
MD5:	6C79FBCA98BE0F517E20EFEF0F6B0C1E
SHA1:	D54160F3B8F8B251C73F08D6D24A1E4158A0DD21
SHA-256:	69280E36735E39E2047611D7962EB80994EA7A50C7F856696AD7B84EBE049488
SHA-512:	4BFDA598D4C7B3D2AF773FF2F8351B04EFF824EF6E1F1086DAC2610B8779C6B629DFD660586CF5161F7D00E7FE60D73AC6337B33BCCE9CE8AF31B9BEB70CAA67
Malicious:	false
Preview:	7044.

/run/systemd/journal/streams/.#9:4089886SIkrci

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.403906093334141
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+0wrgdxsjsicWmIET:SbFuFyLVIg1BG+f+M+0oTjZcHBrt
MD5:	88746E3ACE6545FA70144E54E3450826
SHA1:	8C70B2A31BB4C7E1046E6C9C9C9AA4CAD3D2C20C
SHA-256:	31E867839449CAD8843FE5B0CE0BEB04EDC49E36BF7AD9742F264000ED579B8C
SHA-512:	50183B8097E1C75BC3EBFE37ECFC037B4BB90DDC4B365117AAD09923528735FA10364104A64EE52760CB52BB99012067DAFC896E7E872ECAE43D260C91ECC8D4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4a0a2370878e49768ee3692e52bd7ecb.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:4089899E74aZi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.52832325394892
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+zlvTjFQMzKaBu:qgFqo6g7/+0+f+MiRNTmh
MD5:	8E67C5DAA5BFBFF316BF3774C4439BC0
SHA1:	0A8AB3389353CFC8FC99DF7EAF727F8F47040346
SHA-256:	4C4E5A243ED108FE2FBB05F9D529E8CCF2F964227BA4F1CC50F0748083561D3C
SHA-512:	8FD8B11CE6BBB78F7EEFEF7A51F21E9A2E1556E7A06C509A7B09DC7D762B85B466F4CFC95233AF86C242A389527B530703BC42A354386774CBA5F99AECC2FDF4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=418e173476954dcab097058e1a6f3769.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:4089901HSc7Ji

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.503346527768746
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M61oqs22jFQMzKaBu:qgFqdg7/+0+f+MO4vTmh
MD5:	5C8FCBE46159A44999A6D5223C8D04B8
SHA1:	6352F2CE07267BD7D55D61478DC96BF118316032
SHA-256:	A6A4E0CD2087AA789B27B62AECCC418014C1E220680F148CED40DF2CF6710D1F
SHA-512:	9D198CFFE6CD075B620F49642A04E73867AF3CA926CF7A0161E3684566906F7C45A392858737675271D07292BD1455E725CE7BE1AC620357D9A6CC0C51779F1B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=082cf3ad436741dfb6cce3fab934b04c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:4090083WH1qAf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.3986718990026015
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvK3BdWHTLGYlJl02R:SbFuFyLVIg1BG+f+MCxYyYlPN2jZcHjv
MD5:	C2CF037F845BE3A13C4E04125887BAFD
SHA1:	87FADBB8AD59B8B175BAE6FA33CAE5843259633E
SHA-256:	5BE2FD8A8798A1FF4A53394E90CE30450C2A46ABCF5065CC4A8E1C4BCB7701F4
SHA-512:	CF8FE4B732E970813F915D229DA5C0CD355DCBA5DBB1BEA371AE985CE4D365E92BD5C3B654D4F4021D16787BE3A0F65B1968F549647D773BB0F03E7E315ADD64
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ec87ab9585fd4b66bc7f444fd662ec2d.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:4090131tT7tKf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.378687219073513
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy3TSBPSUR+B8WdSRu:SbFuFyLVIg1BG+f+My3eBPSURMdjtWL0
MD5:	CD2D8B4A479047C1E06BB07998447011
SHA1:	5D9DC048DF59ED95BC085A2FCB1E5B699AB6512F
SHA-256:	F38B2876D479F56D3BA0236AF88AAF92FFE3624543E367AC7E70B803BC9F8D87
SHA-512:	4A4FCB4D16C065ADD423B0E004B23F7FDF23AFB2417CAE210B98D491AEBF805C3DFA9505A737CB0A4FA07280BCAA85F8395A79C398EF948897C276384FA26ADD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8343467df6714a2c9c7afb3872d0612c.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:4090239frJQLi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.420840494831646
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpadR4Lf/cNEYglsja:SbFuFyLVIg1BG+f+M8d4fUNEYTjNE
MD5:	B6F381EC30217EC35F51A33AC53F18A0
SHA1:	EA3CD543419A5CD9E81424A6AC07FBB19DD271B4
SHA-256:	4696EBD29E10C97F383D5DEAAB397A9EB5ACC482C254657FA7CB982164720B66
SHA-512:	36AEF236AA88CF3BD2C73BD6084F8BBF8CA606A94632B89D37F620D5642B87B5BA8CA99918070FB8C22E2864D30B56ACC10B3A3FBD8A55F5AFA128334BCBDF26
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd5f0229e01a472792fb88009be3f9aa.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:4090379doNjtf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.338576945663159
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4adiNfBVBRkEHNFhJ:SbFuFyLVIg1BG+f+M4adUVSuNFZjoa
MD5:	874AA8294094370FDA0420ADAF00DFAB
SHA1:	AB1F6F80254E0A0939ED0BE581FCB525EFC4059A
SHA-256:	F3FF3258247B6ECFD05984900B0DA565AC20E3C05CD73E81A98221FEA0D8497F
SHA-512:	8AF2004E8B67A60174A90A8EA1029FBD9D4EFBE3D733FCFC68B2DB794295491F1F81446E593338E94FE1177CCF3B3FA05D818AB5189DFFFDECB425013297B2C8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26380fb116cf4b69be6240d4baab11a6.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:666070qFXYIg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.36238103228823
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsAqN6BQgmvejswkCM:SbFuFyLVIg1BG+f+Ms1wBQ5WjLkGq
MD5:	F547833E8D27D033D1F78E98D28B4B1C
SHA1:	19647530B9F0C9E40C8973ADEC28B90B87BC86A6
SHA-256:	FB65C7DCBCC45350FC1E04A707C1F62FAF6AB78F94FF571179C3D7ECC31A2E03
SHA-512:	B24E6C47D068BB824687545E58E610FA65351561C5D1D5DF1679D4D03CC1E78ECAA8ECBB89662D25C74FB38F17DE3BF9722A7391DB76DB1F728166CA1505AB32
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe0e6d120d544041a3abd2aeb0c870d8.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:666071K2ESxi

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.509442370123506
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MIySmcRQ9jZcHcljX+:qgFq6g10+f+MumxmAu
MD5:	05A8F8DBDF137006690CE45D09B15AFC
SHA1:	52E6DBD6A8D57C50382AD2C61C5722C0A3E882FB
SHA-256:	1E2F29D95C61DF08282816B857547987B93A49EDC13FE098BFA4D4AC2C308BFA
SHA-512:	1031712175315A9DCEDCF0FB83B888FE65939193E5C7030B005C5EFA94C31AFC968889F38A24082424C2975EE6189183FE7D6EF6BC98D31FF87437423E551539
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc0c4332fb94479e88a6f199219eb459.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:666072Qi4iQe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390733871553765
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9wg1AHQW0XsjsmNzi:SbFuFyLVIg1BG+f+M6g1AM8jdCLKzK
MD5:	36357508C0C9EC7CDFAF70B426D6DF1C
SHA1:	DD6438FB65F1ABEF4FC1C04C3444757952127DD9
SHA-256:	866408175C25B16260595DEE750FFAAC195FF74A1BC09F9BDD4EEAE0DFEB3236
SHA-512:	979FC9C33EB9C900C594033CC04EF523B2CFD1C372DC01C0A3B45EAF6BAB27616DF4E4ED7CC24AC6A803DFB4EBC69DD24215D90142650A370E5FCA08ACFD9D40
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7434d7590e0140d0a626b5c138dbb84c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:666073BBoAVh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.416880403724284
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm66AnQANWUTEvsjs16:SbFuFyLVIg1BG+f+M6r/b1josQu
MD5:	894BB4E9239E0B4C71F7AF4230403EDB
SHA1:	C20CE20FA0BD5B2385B6AE88D496A9C18551AA05
SHA-256:	AAA9ACEB77C11004DC4920046DE06D59C3929ABC23649C3F5E8937F2B9C77829
SHA-512:	AF3ACBD8A18C901D4D2E729EF4B9E487DDCBAE5E1DEF7C85B7D16F7F0A901725FDEC9BD35404AC039F9A8FFD97DF5216E313F0F021FC6AFDEF292E79FAB741F3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0ff9fecd261845e2839af661b3ecba0a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:666080SZ2Hvf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392409427061445
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvPyWmDIuUzshuqjsV:SbFuFyLVIg1BG+f+MC5kukshTjLkGq
MD5:	F96F5A982F3CDFE5DFF38F095F7CBBEB
SHA1:	833FFB8D399BEC1DF1CDA439196D50CB68C801FA
SHA-256:	CE8FAEA333CE49C776FF77CF904ED34C8FAFD62BB5FB983B9F45E1073DC21A4F
SHA-512:	2F99928BF66713BD2F224B424C5123E0436B91EDDF446FAF62552BA1D7677C07D4CF9D5339E69285EDC863B934D0BA07E31D7459FE7867169B0F4CED1EFD1F31
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e13cb24d225444b692cc9b2af0d9ab1f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:666089nJwi3i

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.43937908872258
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MuM2RpbTXogqjNALyAZD:qgFq6g1af+MgRiDIZD
MD5:	67F4F2D332C9294F30E71564B0EA916B
SHA1:	2947C2E2D0A9C39602213D72A823BE98434A84D2
SHA-256:	5AC9241F6E98257C62B2BCE4F9568A45A6B55F4492D938314CE2D2E4998C38FC
SHA-512:	1B01ABEC092C5E82E5828C1DB5CE2C60B84C9E75C91B8061EA8F1FEBC4EBA880C309F0020487093845547540F75EA3E57E8C2EE45C03932BCB176D80F36191CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c59710decc1340479627b4c1fc6f80c3.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:666186in2Cci

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.474826558383349
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm93w8H8gqKD022js2BbM:SbFuFyLVIg1BAf+MmZgV2jNdQIeXD
MD5:	B5B0CB0E9D43ADFDD9228CC61F350431
SHA1:	BB1332263DC7E9F8C2D16E978ECE583E646B1B51
SHA-256:	587F69DB6BACBA39083980A6421B5AD91D4DE285A66FC8C6EC1E09B2AEDF48D5
SHA-512:	4DF0428E36A5B5F5D2772455B48EC82AE962BE4019A8A9B3E21CF5F1F596AF418398DB6C100EB22DE922229C9720F54952C61DBABB5812DBFEA92DDA634398A0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=77adc3ec8305462b9999147a50eae3bf.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:666265rHMqSg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.412993117381491
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+kR0nT/VUT1HxvAglsH:SbFuFyLVIg1BAf+M+kRwT/+Tcg2jNTZD
MD5:	5AB05DB6F009150B2DE63AA25DAA139D
SHA1:	C588B6426028823856736782A78A49961D5C106A
SHA-256:	BF594EED46EECC0A338563B616F7B2E9BB254593F9C3E04C8A3FAC0CC695CBB6
SHA-512:	FBCE686417E1E7C8E8F22ABDA1EFBBA4B73F11005CF0FC6F2B80568D72137D930C4334401508E384F40DE23145D4A059D8F0D8C7CCB0D9939B57E33D4C381DF2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4ba43950d2a747c28dc6382160c27bdb.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:666365i86Mtf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.460633224354211
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+T1mjNXpjLTTIWTIL:qgFq6g10+f+Me1mZZEWEL
MD5:	65E208BAF02841719EAB0BBCF0494C64
SHA1:	DC2E421D238B7AE9F72DBC0A77A9F4EF2CA47785
SHA-256:	CCA4F72CD72903547A07442C92D388A8733DC43B91761E9050ED893763CB7948
SHA-512:	4E88415695887838844BFA7CAC8B5FBB3B89E5EA17A416A0755A14575EFFDD5B4748F716995CFD002A68BCC1F2575E5148B5D13124DFDB6FF503B26A7AF1653A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=474f3b08f54e443281e6be12b178981a.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:666471xNaI1e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.426077599177026
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmujA1dC2Qz8jshKJv4:SbFuFyLVIg1BG+f+MujA1Cz8jbVC
MD5:	4DC18B9D45CF3AB2690B084FB07817C0
SHA1:	09A835C8EA21ED08EB98478F6C071D1147CD5074
SHA-256:	2DC062A6E040F26B81F434965ABA0FF24361F3BCF666820F55FC354B5020FB24
SHA-512:	6A1FA2C2B27585E0AA792016F381BB82C04CC6530CB9B6D0E78E0E1BBF2984AB6090468EA8738D62A961DEAE0DEA805AEDCE9A004C900E09B5F3E85B03A5DA92
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d327fee0e8f74e11a86f5588cb696d2f.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:666517XGjcag

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.414597905998062
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmp7DAsEKg0uwQDvr:SbFuFyLVK6g7/+BG+f+M1jhruZv8jNq
MD5:	1532C74A949C337A6628AA7BCC294F28
SHA1:	FF745E9B41449D8B879D00C03C5C78C31D34062E
SHA-256:	D8BD021F0D16F999CEBB35A56349C0254610C3F341EA3EA74089E3688863B776
SHA-512:	122289C3036BACB198D83575305D365D731BA23AC3050413986922D7853891C6FDF501DDCAD82525CCFF45847764AF9409E448907DA680BA05AA4005DF5CD795
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c67c8bfce55a49a69cc94e48583dc35f.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:6665195PMvNh

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.392215711246266
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmoATE/DAQFo0Zjsz:SbFuFyLVI6g7/+BG+f+Mo6ODAejNq
MD5:	DDFBB8CA5973E2926278C424BBBFCEAD
SHA1:	1E3EBB4D4E7007CCBDD83D9020AE9FEF5B56F8F0
SHA-256:	AB5F8C9C4C58D387E923ABB6CB8F84818F2D3897930822939E64A21FCBBC68D7
SHA-512:	BBB56131B94C8EC07B0D50759694085970CE51C7656312EF9A7ADDC6BB633A09E036CAED830C827D722C6CBCAF71A7114AEC08E029E22BDCA4925FA10BC3FA80
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bee10abe86ef4777b0e7d3192ffd9169.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:75444cLFyfI

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.520838240754371
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+5rXVHQcPEBEvsMx3:SbFuFyLVIg1BG+f+M+5DZhTvsMqji4s
MD5:	93686FDBCEA79AA723F6639239FE7737
SHA1:	20BFEAC1C28C5148B2C90C7DCFA0F4BEFD29B2E4
SHA-256:	9535978901AAF2A0523FD503786A295A8DF334432B1EC9AAA92DFC9AAC192665
SHA-512:	FA5992C17435ABBB93648A96354549C64BA2C026F9D3F2550A1DBEFF489DE67ADF7CF191C12E73FBA6E5B958908569C3A6147BE5819C49758F9F9F2EC3B7BD66
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4387b6f620604803a65d706f34b2224a.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75445pDZDWE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5026415752343265
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmusWKQLIGL5uUtuqjq:SbFuFyLVIg1BG+f+MusELIw4UtTji4s
MD5:	037D421B0168F4E64088AFEC7CACFB99
SHA1:	61AE6F3E315B85F463F216A9C67461AE9BFDB5F1
SHA-256:	0E0496C0AF5AE47E87DCE22C60940A051DAE04A503761934255BE33FBB0A8F0F
SHA-512:	5412CE1BEC893DC26B09F26D8E917AE1539CAE37623A502D75108E1734AF94BEAA700A41714AF78F6C36005AB013D3C1FB0AACE7BB79AFEEC0921E9B6DD32578
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dac3f3c85f214c5cbd51e1fe4213464d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75740KGmXSE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.460264220107598
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7RJJTXbXTwsjs1Ha7:SbFuFyLVIg1BG+f+MVbjZjosQu
MD5:	936B62B22D03D05B25AB6EE7CA9297EA
SHA1:	C0E5652B26E131F3E3D65394A9A97C10925C3A73
SHA-256:	0142D33766F759EF0793C5D864CCBBBC19A0F36E7D1F3E9F0783DA1209C79549
SHA-512:	2B16D2FBC65EC20796D04E003D0DB78FFABE0B58E164B9B16DDD8BF0DB17319720A173DE02D8DD925944B2133E1B7D13EAE20CB602E8694D4DADE6EDC241CC33
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=168ac427bbde462393f4f295b71c62dc.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:757466fH7nF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.412801614177722
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8JIQgRmMz8jsmNz0/:SbFuFyLVIg1BG+f+M86Q5s8jdCLKzK
MD5:	B1A262475092A79BB136237A153A2D28
SHA1:	FCD4E30FAE41BAB1C6E2936CACBFF5253BC282B9
SHA-256:	51DA1CB2E18B59751FB13A206F776BAB7AB191F1171EA4C23A45B85EE1FF0220
SHA-512:	B25444DEF5633739EA7C24E9025E8CD328CDC56FE7A794DFF44F51B184C4BD308DC99D2236A898EF919E68F7558D68D4AEC278988DD72A3DA5A13669999F8CC6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=659574a245d348cf8bead64073b6850f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75753IpDWzG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.32148037065775
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5ORw20EHUGDFBcPsh:SbFuFyLVIg1BG+f+McRz0GDzzjtWL0
MD5:	57F01AE3EAD1D363646A0D241C6893A7
SHA1:	FCC09652957225E532C85188A3585825A860F956
SHA-256:	E8A78DFB7BC56057BB362B2AB38E329AA5129BDADAABCFD7107FE5F6EAF1ABBE
SHA-512:	2A0895B1FBF603597D12423C0E4A3048CF781BCDC2995B7CE2B1D0B23EFBA7B2A2B9029FA08743C6D76E09098B08FEDB701CBA95BB751FCDFB62881E1EEDDED4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3916e4e7e9b447babcfcf007f3494a9b.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76641D7UZNE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.425486502135584
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8EJUU8dWA/WgAN2ja:SbFuFyLVIg1BG+f+M8UN8BeN2jNE
MD5:	6D057687FA8A388DE0AD177605BC8CB9
SHA1:	BDDEDCEE9CC8D85CD3FFFF8F3890B2CF25AAD7C7
SHA-256:	E007B4FE432925A6FF1C5B6143CB7C985897F403BD6F6DD34C5468A33A74D976
SHA-512:	F02726D76A6299E5BB8C75440B107505C60C2C0355C306C60F8A3CFEA606687FC78F674965EAA5BA11C92A6D3FF8B76C3816BC08AF80BD553A7B7AA049EB89D5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6a5112a48cc64116b04f5883e003476e.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76642gwFOnH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.449691997630083
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+F/BuCfTjsicWmI2d:SbFuFyLVIg1BG+f+M+FpfTjZcHcljX+
MD5:	A2BAE72D1C8184412687AF9E9731EC2F
SHA1:	E3C807D53256A8252C994B74AEA21D4BDA253A12
SHA-256:	D091AB244FA279EFFCF8D88A1D47940E8AEEFE46202F758F6CA8BF82EA1A4536
SHA-512:	A3558E3E37E3A026A1D5731F408DE40A94E58773A10B1ABA9AC07203891FE64DF02FAD070348AABE0FC72D0B468A2C1CC9AA7DF49964B7645F019E2D616AC382
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=43505e0dab2044c683d676a518d7ad46.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:767572gAnKE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.42123019205658
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5gADcnIkTYdvshg24:SbFuFyLVIg1BG+f+MyTstshg2jbVC
MD5:	8FF226D1ACBD24569FC8F96BE0667E50
SHA1:	FF34BA6D00DF144349EA2587186E4C21F1E8E397
SHA-256:	FF8E55C2CEF52F511B458D4A7EBF086141C70D7E54733277133063C8489AB04F
SHA-512:	E8FC058BFBC8D626F4DB55AC45FE849317B864B468F5125EBE03EBEEEE9D7AF496D6CD598F3E1A668406B70796929908C5C4235A24C59C6C7544745C7D22A631
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3772371e3a9d48fab42fb3b6d461068d.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77152T5yGwI

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.447553284436139
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9+yXdETuEvcT022js2o:SbFuFyLVIg1BAf+MxWCpT0ZjNALyAZD
MD5:	9C815A32F96341479A9A5D0C2741B760
SHA1:	4D62CB60977B81ED2D1530765E163157E003E5F7
SHA-256:	6BCD52CF92F6D8143FEE20ECF2973A7D7F5F64DF85FF375E8083F3E544845685
SHA-512:	B9742AA060D422171AB7D6985C15D4D585CEAA66E81F59B5D18EBE401E1898533D8CD6846F5BF8EF3F3976F25BBABAB413023AA3874D9A93841FA9BB4E2DEE45
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7b9d42cd2d434128a1070b9abbcf3296.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77215Bv1TOI

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.469872143418341
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5BH7DWJdWUW4Xv8js2y:SbFuFyLVIg1BAf+M7Wyw/8jNdQIeXD
MD5:	44C2CEE5AC39385778FB652C916894F4
SHA1:	7B5815301BEBB9CF1DB760C752AAD0268A2C8343
SHA-256:	819D90684CC9A29F85A7D750E8ABDFA9BD2BA953CFE06035128F7BE57AC4AD4E
SHA-512:	FCB0AD66717E463AC577ACF47A0A94AB8997679C53D0F2D450EBFC8FE6A63674BDB5E4184E2C4C9E299D71DE1ED32F2926CA0AA031CF9C0F4AF51E5060950501
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3c3b183c1f81406d9d5b313c7fd52af9.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77308Utw8XF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.432623503872023
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyH8oWaB/shuxsjswK:SbFuFyLVIg1BG+f+MyHjWaB/8jLkGq
MD5:	469A5CD78A04C6862358A40B6E12E49B
SHA1:	7127502A8225DCF1D1E320BA0447C9D858B861D2
SHA-256:	B3354BE0CE891CA87A0A2957AD5DE835DEA7D1F0919EB0A4CBECBCA4D3BAC819
SHA-512:	51AD6A3E61A11539002949C6230BDCCD5FCBA97DC303C8D23D0E2086315A11A8E4D22FD5A291E9A542181E616D7A6C4803EA7F715F750EA044AD6673B67FB991
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=86fa36da18c0404b895f7f253fb4e322.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77325nxEu6E

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.453250621280616
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6lhDnmBrxsjsmNz03:SbFuFyLVIg1BG+f+M6j9jdCt/rRMtq
MD5:	267F38E592D05A782F0DDDC5557DBC78
SHA1:	DE8D2CBD49F7983AE6DCFF7AD2A27CB1E6A691CD
SHA-256:	EF904638A9BCE10DBB5C7DE730BCA86EC433AE2AEA9C05E02A496C12041D48C1
SHA-512:	2DFDC425AA2D523E9263D4BF9DD794938F83DB77C7723010A9FD1B7D0F424E0D5D845551AE0CC49414E4B9656390530004E229D2B31B90B6BEC38C992EB9563A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=02df1f407f5c470ab0fbb49c1112185b.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:77408f2cthF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.420579926448459
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+l7JESTUHF0js2BZZGu:SbFuFyLVIg1BAf+M+l7J7yF0jNTZD
MD5:	022C763AD9FC6F2CC88440ADF7D6B1F5
SHA1:	BBEB04DBB185D8E74D52FF3E4A94A7C742A15BE7
SHA-256:	B77E9926D24501CA668579362C9AA0B7E3243C9BFBF4EEE4098E5C213ED6DD01
SHA-512:	AAF68AC01B858D96BC9B73F972DEE2A090E5938084029C6591D1C5766CC1B067EBA41326FA195057505FFDFE9B3C8EB109E565E0F944259F002EE128BA614ED3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=499270d960434523b01a7f4d189d6cc7.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:775054oWywG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4228264518847435
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4wmBrSqjLTTIWTIL:qgFq6g10+f+M4J2+EWEL
MD5:	3AB12E99805A15A9ED573FB4AE07D518
SHA1:	B4FA392DBE8CD2C45A3F6E39FD395BF17FCCD742
SHA-256:	D4FCC9EDD3A36F7B4268DC598478F5BC48BB0D0C24E23C504E6820D0DE40C6F6
SHA-512:	B7BC305C93EB450A0DFB83645F0CD1E96A620BC868F617508B6B0420909741C6F5AFC7194A3FBB08D5CC8679878AED94F1327904ED5DE4CAC83467BB7F360B03
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=27fd54d793af4e69a20ebabf403503a2.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:77535xYTF3I

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.376931352316286
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm4+SH//E90ZZUQ2Q:SbFuFyLVK6g7/+BG+f+M4+69qDjNq
MD5:	4B8601B9705003198A866AB5CF0A8C26
SHA1:	B5B969A2C6D2A068971E8C98F2F11872055CFC0A
SHA-256:	AECB6CB7344738F0F313251DBE37BD54FE70E53052593200C3E8AE995B57DF04
SHA-512:	AA0EEDB8DBA2E827A1E6856FE304A04398D084239809D77B332010F96B9B9D7788C244E6164FC9C73B523B15ABEF8C3675F47E8DD8D46566E7B9FAA13EF0B6B6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2017b0bed92445e0ab75f0e4ed5601c4.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77536IHzTwF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.3709761756048495
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6rslOeRQ0i+sjsz:SbFuFyLVI6g7/+BG+f+M6qpiTjNq
MD5:	74EF7605C7085B09A12EA6B880A14331
SHA1:	7395523944BB2860D630D44D783054273D86CE06
SHA-256:	85477BB5A5D8FC0EA4F8AE078E6ADB85FC80E9A51D24ED487AFF9298D465FFE2
SHA-512:	DD6407066DED3FD22910C85EF0AF7478EC725E39F320D50CC45D7DE721C761F1877ABC12981FF49DB7FEDB5DAE8EAF1EFB8149812543AD0F2D774BD519718632
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=040ba33d249146a898a96a70327a7242.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77565CMohdF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.504696927670299
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+CRAa5YjFQMzKaBu:qgFqo6g7/+0+f+MTAa8Tmh
MD5:	FE54D53ADDEF9D6AC2366BCAEEA6FEEC
SHA1:	259B83399164783E60739D2BF73E821F90791A8B
SHA-256:	85B40EC793A7AD2420EF9073B1BB4B829350AE941F352959DF14C328F6666D1E
SHA-512:	8BEA10CD8FDB1339F7A01EE4E7399A76BF476A8C91269EA23189052419C4F43AE90336C3EAC272A85254614DFAF64CD671B98361E07820DFA2A5E11D3D559122
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4db99e2ea0434d27a6167cbe0a055fbf.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77566AvFBmF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.521133849166411
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Mwtqu8vQjFQMzKaBu:qgFqdg7/+0+f+Mc8CTmh
MD5:	FD943C3F64E354982E235D232F2E60EF
SHA1:	CA5EC09361F95FAD624B83B998756807CADA1427
SHA-256:	91D31E16741212DF5B4945D997C7C9EBC8F38106592F69586714402775238937
SHA-512:	9B95AAB58F3EFB0B8BF6324991A45CC586E57A381F5C3B2C2837F5A6802922D11507F3ABDC84736CCCB9B1D162BB561EE7D1F86162F9BAEF1F64A4792132BBC7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9909ed86467e44c391665901df753117.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77619rQ5JmG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.394967450982786
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+My1PB4XFUFjdCLKzK:qgFq6g10+f+MWPAFUCLAK
MD5:	1E4AEB0EB8BBEB28EF801A901EBEBE74
SHA1:	92299C897BABED7398988D5D948AE6FFC89961FD
SHA-256:	3A6128B4FD94E25588915F87A14483A8527772F692F9F0C37CE90258E6BE77F9
SHA-512:	41C0680D1F0237C1CB0657E52DD9F5CB57D8F7A0AF63C3476CFBE8639EE874851CC403BB624A183B989C9D30147FDBCA2CF2B9A7B0763888A824311385FF121D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8363064f53734f8799a0488cfec2c711.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77715X6fNkF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.379442931430704
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzmVuKE1Qx6UUvXsj+:SbFuFyLVIg1BG+f+MOudQx6UU0jLkGq
MD5:	53C48107A7C3F3FBB9844B6389D9F3AB
SHA1:	A41C64CA701952CC1BBA77B0A44C592A8701BAE7
SHA-256:	FCDF857C1AE44DEC7C21D55A9E1C329085EAAF8994D9B8AE4C8762DE650C6E19
SHA-512:	FFCA40B4CBB07740E7AD1BF8C19116FD4E3D55DA240A194573CD5A1861D7DBBFB3D3A87D2EC1B119E70709551AC079A7BEE4A4BABDBD719432F3AF2744970A01
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9a1c0240254b490fa0bb5f5d1fa21b7b.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77729ZfXTCG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.399389011264248
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MATXj3j7822jdCLKzK:qgFq6g10+f+MAv83CLAK
MD5:	D308BBA919C04FF402A473849A6D6B69
SHA1:	CDADAA94A4974F5FC93A321D5B3CF90F89655B03
SHA-256:	9F7195D72C8754333D9A74A82CEBD92ED22D1BD751734065369656C1C3ACCCD2
SHA-512:	8520243222B2670F95F5854011B418589437A85E6148C53E1BBD8E0E433F1D5F19CFB18FE05830502176D08BBFBBD7B4E8C94F7D89546B6EDC7BD222AA18B3CC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=165ca2e7dc3d4d068611cb2122f547f6.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77747Lac4vG

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4245790899244435
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzRHVA2PViN2js1Ha7:SbFuFyLVIg1BG+f+M9HVAMc0josQu
MD5:	BDF8DB0A305045EF38B162743D8AA2F8
SHA1:	0DC4A285E15E2D1F5DF8F9D8D9BE0CFF4B3BBA00
SHA-256:	4A09E5E68A1E5BCD47715EA261EDF531403EC742668515508FF8B37A07E8B0A1
SHA-512:	1FE344AED33AD9AE25BC2B683AB0EDAAEF8137A19524B2243BFBD9F763F89F31D7B3F435D2E5CD410A077947918BB4FA5C420A435BB8D0EF6F20E1EB63FB485C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=928fb09d1b0540d4825a62ab7911b7a7.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77785JjUsVH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.475760963149792
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7TyQAGC3d+E1Nrqje:SbFuFyLVIg1BG+f+MbAnhqjZcHcljX+
MD5:	532D8523CA02C2616F77A29BA50BED98
SHA1:	59D9151E09202521195220C6B0E205D7C4E2C187
SHA-256:	46EA4DD107E8895739CD227B5FFB5C3DE8C09573839A46686D7F82FA8943885A
SHA-512:	EFA37899756734FA542C3E528FB56411DFC1B968BEFF2C5309051132A5BBDC305B3D125346A2703809940B85A3251B1EA9EB73DC0D9706B12DB2A67ADB435D4A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1843123593ec4b5fa31527e8e58a2aa9.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77808GY1XLF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.424215531365273
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8DimH1vdsdvATjs2ALl:SbFuFyLVIg1BAf+M8DLVYATjNALyAZD
MD5:	788277F5485496AA20CEFD760B904582
SHA1:	D64A081193A6F8C82C5355EE7F957E326446CC5C
SHA-256:	979F1A3330117BB2F1BEBF8B3E5DC260A074E1AF4672C148651BBEC922A7791C
SHA-512:	FC852AE4FEFCE813BB1D8A2EBF40E9E37E9633987F640CBB3E756709F5ECD97EFD8ED9F6D3881099BE76275D1317B2DC6B78EE7622241CAF5A6FC57A6AC0DB2D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6fd1dea5c1394ba9944e42a56f4cab38.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79094zybCKH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.442812873538972
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpNxSEiRUOBLdPsh+sjs:SbFuFyLVIg1BAf+MbxSJCOAjNdQIeXD
MD5:	2EEC272D9FE14899DA924DEB84E4AD93
SHA1:	941AD105A3B4ED08328E47FAFFC0942D823CC04B
SHA-256:	8BAC7B6D36038E84F30A15F77A85F5090C29F192D02C252A359F11ECEC73548D
SHA-512:	B93E647653D194A437FDB59E45A7F077531C94D7E99A1FEF49E692F8B2A312763F6AB1ABE283F1B7DDEBB2BE96F900DA366881DECA0C31D2CD5BC08D4CFC5030
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c26ec1a7ad7a4a4d8ee5ad619479e38b.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79265c7YNfH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.385241068356322
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9lE30eDUkPdhkMxsS:SbFuFyLVIg1BG+f+Mf1qdqjdCLKzK
MD5:	D90E0754FAD852BBAC51A2157B7C4A66
SHA1:	29E8004751D1B70B74D235527D01DF1A7EEF2B3E
SHA-256:	87F61A57661546B40C75CCA49E579C5F07CEC0A14757BAF98A15046548CB442E
SHA-512:	90D218D7EC839C26E084CBC41BE4DDD5DC38A901050F52F73CF82375C3CE4EEC0B6CAF34E91878ADB10CB10E715FA8DB863CE82ED7E14DA2ABC8F7E341DC0173
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=75b2e14ea5a44e4380f102c131698952.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79266fFhaUH

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.437047631523027
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/KEknWiFShX0h+sjx:SbFuFyLVIg1BG+f+MyEeWiohX0ZjosQu
MD5:	2F8BEF91C1B8E98B1CEDA4310A3C8F95
SHA1:	97A60B7C1C512CCB195EBAB0A47E9E2A6EB31A48
SHA-256:	621D2B64B3739DE8170975ADA6BBEF7B277118818ABC89959DB83E1CD36ABB8A
SHA-512:	B9009C88965091D949EBBFD0DD1C5784ED2727AD7B61315AE1AC0AA6F457AC941124D15AD6E7100D9F153B25F147C83DB8F510987C6486ADEDAEA1F37170A6E4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5c85fff77cc343a0bc1929fba977f12b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79464WGw25E

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.478430719982175
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzpEsD8rldzRqjsicN:SbFuFyLVIg1BG+f+MesD4d4jZcHcljX+
MD5:	FBB81A259357B53336733BC9A0969D3E
SHA1:	D69553A820CD4985C13F6ED6E573FFC604D5DB75
SHA-256:	53FF4524DC1B0F6126AB7D88D6523C517880E686FAA7E5422DB8DD32AA11F5A8
SHA-512:	9925B4B7BCDB3A8BBD92D4B63F7DBF763C9F809C4E6D7C902431C19CAEA61E70969A65AA0373F85EC1F5B75CD0BB87CC367741CCBE4847D4E6A923F4D497BAD4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9556a13aeab94d388d1780302a92df8f.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80473LTjSM4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.532641377637434
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyNB8lzmd/Flsjs7LH:SbFuFyLVIg1BG+f+My2m/F2ji4s
MD5:	74E8EBE789DEF79A986072F52E33676F
SHA1:	CE3D590E4A9F2633BAFD33A469E72D36F72DDC67
SHA-256:	453970F5F62E4C7D4C1443E5FAED1F14A3A6CB8DED2986BB909A102667A697D3
SHA-512:	0AE472196D9B9E182EAD356BA765185153598597B9B5D0D25C54F994BD6BC5855297F45B7B9930C03A28027446B8EACE39E121474A006838C3BC0DE2B963C7C3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=828d65603d9f410d96cfe72958da7082.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80481FMk4p5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.382794042446058
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpkhvBdUnZcN2jsmNm:SbFuFyLVIg1BG+f+MOhvr8Zy2jdCLKzK
MD5:	D4497D85B09D699D14FCFCC29C1A08D4
SHA1:	57004F69FD803DE46363300DD584B3BB80B85364
SHA-256:	5861AA3B554BB2248CB85FA7CD93EC8899EBA0C5870143A550FFB176F35FBCE4
SHA-512:	F860F30584E019A39A386E37ED076CE6C6628B7390D4870F40E5CF6A1260A6A5B9979246FD2343DC0C8B2B93EC1F7DD52DF5DD2E569D6CA17CB8817D4082747C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cedcd00c3b8648159d679d81d42b1cd9.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:8048207sFy3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.403605947942339
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5ADkVQVDmcVWA+sjx:SbFuFyLVIg1BG+f+MyxpmcVWATjosQu
MD5:	C3C40F7917C733B53E6DF61F4495335B
SHA1:	9F8A2EB81E8F93AB995D22EB0C918CDFEC36F3E0
SHA-256:	99FA7A02B9E35802421A47995094F91AA3AA215F0D85BDC6D964C57A486D257D
SHA-512:	2F014908B10570BB7A0A3A6E135545FC31A085EBA97E9CD3E67B443368EDBDE28FF9539379BADF36CAC3702CD2A459FECA96FC8AC1AB88B3E8D4F4D863358EA1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3f7a11f08eb54033a14de0f92913807b.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80494nCRz34

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.473796401761022
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm73SkeEc0V8DGkxsje:SbFuFyLVIg1BG+f+MhxjZcHcljX+
MD5:	D70CC0219B0ADF61636602A3A0D71D78
SHA1:	C03A689587B43977CC3A490AA24A43C9AC316460
SHA-256:	8C4D8427AA0D6149CE64F2CC9CD038B28047AF18514E17F5C22BB6A801F5D463
SHA-512:	CBDC7C71FCC59DFE644F73301E1BCF5867CC4746EF4648D9C3676587498D7488E4ECB42AE7FB0BC4B5FF951167CBC7EB583ACFD3685C6C52B99BCBD5CD0FE6A7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=10872ddf2d4147c38c908a026a4fc672.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:804956L9E45

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4118413692728184
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MKFBGXB7AuqjdCLKzK:qgFq6g10+f+MKnGXwCLAK
MD5:	8A2E326F9F835D8B3A23DCB8628ECCAD
SHA1:	EDC6957D4CB74A80B30442705F0635BD493B64D6
SHA-256:	623179696F29C2DB42520C506342C6BFD9082C851602D174ED9772DBE83F2791
SHA-512:	DCFE74FD29BB67FC1D144FF6546516DD9939DB1983300C24F1E0A081E15EC42859A8602EEA2CB8D3CE35E0DF378797E591B28ADE92927A8D27052DC5FFEB3C2E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cc2174871eb34dd593cc25186bd5caf1.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80496gdtFK4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.430730129242657
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmryV1VnFUaAQNTPRxsj+:SbFuFyLVIg1BAf+MWV1xFzdojNALyAZD
MD5:	70680F27C73688BEB7204332A446010E
SHA1:	2F17A660A6135D898249603588B3B200938CD9DB
SHA-256:	45E735EE8CC96B972201973A3E96E9FDCC410347E280715F8F5FCBFD100253FD
SHA-512:	80FD83F39FA54C9D97AE4E44105EC97B21A26FE9FD8B8C316A080E60963DBCD9BBDEE186B22B5C5FA1FC273B6861CB6A9641E7B45709154483CF79553B2C59C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a7d07c0934ce48599af402e978c28622.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:805046X0Qx5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.360135179358573
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoaWlMHfQEOjswkClK:SbFuFyLVIg1BG+f+MoDGfcjLkGq
MD5:	6449D1ECE7ED1C89CFABD4A75829CA7E
SHA1:	F7B708131D4CF0A4BF31761F0A7DAC1A072DBD3D
SHA-256:	A58D294E34ADE424F2A2E02A2CA6F969F62CAF7714DCB61D11C39BFBEDC1EBF8
SHA-512:	700A56719E85E86A0EBA8D1D85DE5E191F527965EDFBA7599046C36518BF024FF7637C4CA0569E66FAEAC4D213DEE6FCA2191E348B935946D5DFA5F76771765B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b9df0d3e3eef4f5c92bffc06abb0de5f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80506t4dYl3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.462167627278812
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5HGSQH37UIwoH5xsjsd:SbFuFyLVIg1BAf+MZFbI/H5qjNdQIeXD
MD5:	308769360B0A340AC245BF4C39455A60
SHA1:	9811A20716BA2D8C4F0E3B5015486399953C2EC7
SHA-256:	0C433A9C8318A2B05F0A532B7DAB21A923730526DDF2F3C0B452DED67507F78F
SHA-512:	3CAF67B2E356E7E3E07D21472EBB72C1A90B809C89AB6444732138B2E976103AFBDF30728D98349229294A2873BC7A04E24E30823F8DDEE461C5A519E799AD66
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=342dc72eb4414e4283587fe5abc57f2a.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80597XJJMY6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.343097454643971
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsGfKVEGRoBdAZ0N2jsa:SbFuFyLVIg1BAf+Msh9iUZljNTZD
MD5:	F12C4D7C47B98CC4540BFC7133CB9EA7
SHA1:	B7433A929801E308068979DD812EA0BC56EECE31
SHA-256:	4E83E70E1FFA176D5778EABF2FB4B6A913B07D56835C282C798F7FC9834B027A
SHA-512:	2EC91D33F36F09B2229FC4172735BF53B9FA2912757E54C7BCA50CE84E1A62EC3EBBF96CF5C0B0EF715829AF965C1392330E7B51173976FB800532FBD4952530
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fc1c6ca5176f40a8a4add8ef8f4a30a8.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80619N1oEU4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.445260911305223
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrqEHHRlGcsXR5qjsB:SbFuFyLVIg1BG+f+MZHvGR0jLTTIWTIL
MD5:	BE319B4C6349B78006535E7C8EF571B8
SHA1:	EF1E222268B9EE63411E6F6CCD1C0EF4A44550AE
SHA-256:	92B50E388BA2B78CDCC4BC9552ACFCD33ADB67C4A23DFE29756734A149C560E3
SHA-512:	A38375DF7E031AAAF3E851AB1FD8431A8EFFF86ED6B1AB7B58BCCF0D2CABC0824B4002D722DC94E1ACA16C253292F80E636CFB0D87302D9C96CC139D5EC255FE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=abf354beddd3473c90f25c56123c7794.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:80631pfm4j6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.424582445584552
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7SRNdXQj2WB6xsjs1:SbFuFyLVIg1BG+f+M6dXixBnjbVC
MD5:	B06D2DA3914C9446AA4273EDCC87505D
SHA1:	146DF9A45D0E3935EAAF13C250ADA9444E8C86FF
SHA-256:	3C537EC6242D1E963C41EA014AD20C8C6DD317309B5471133D2930BB882E864F
SHA-512:	248D446A159EC791D45F548EAA9F0A668DF5841CEA7112A7CEFD97C664947ACF3894E1699B938F531E12DD8FF86CF25866A072CC0CF7EF46975066220523AFC9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=16e68611829b4e5fbb7cc064d2603de2.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80654hwCv96

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.403829365125704
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm76sZjs2BDfAXvn:SbFuFyLVK6g7/+BG+f+MOsZjNq
MD5:	C83D82AC0ABFB096F0FFA9C5601469B5
SHA1:	EC6CCA1B4D53D559E234D8A52C384B0E5ABDD34C
SHA-256:	4EEEFB2E4317BE9D066A794A40C9D78823A3B0E665A219AD19F5D79543DA427D
SHA-512:	E1B8D0BAAA8B6058E3AF1B56D4A9ECEB7991B09C82E773A07AB1F8440E4F593FFE1AF70E2BFA1607345F19DC5ADC944FE465A3F1C25B98CB47C686765BDC0CE1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1a8d1d6f2014416d94b8c6a11ec3d0f5.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80655GnrOT5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.373178532234957
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm9gcaSRAzBF2js2q:SbFuFyLVI6g7/+BG+f+MacaiAzb2jNq
MD5:	D7C9337A6680CACB1F00BB04B91FD42A
SHA1:	9953D684836F78C56084CB8C437D415A26383B10
SHA-256:	A0F33C174AAC9AE59FF9174C9FAFEAF9C39F82C28908AA4312520010F35B8CDB
SHA-512:	40194D91A1319107B0C11EDB95A36601BA4A0020429073A96C2FBBEB1A12D2296E9D2C868FC9F4A2195BE2F5592AD6E133C0F2978A8EAEE744F2E4E1A767219D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7be95e6ac4564da8b4ed5a5290286ed9.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80704EDxj03

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.51998349240362
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M+n1mVZTjFQMzKaBu:qgFqo6g7/+0+f+MQ0VZNTmh
MD5:	371BB582EAF3930E8D262A9E69FACD82
SHA1:	E4CF67CE2747305319595B894C9DFC4B39CCADA5
SHA-256:	28ACA03DDEA2C1249FA1D2F97FD15D97CFEF375FE38EA8433BB076D484038B44
SHA-512:	9E12EB1C3E18795A9D7DD5C5CE69F51666159CE781D3A79DECF609D0A33ED43B0A41045D321FBB50398630BE175EB5BD320298050EB9DADEFD55A5F98D63159C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4990ce7b64fc4ab989934b461ec28860.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:80705f8KQZ4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4913021229450285
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+My2ehSccx3XgjFQMzKaBu:qgFqdg7/+0+f+MP9cUXqTmh
MD5:	FADAC9FAFCC96814F9BE9F0F5438E9E1
SHA1:	894111AB139C81C7CE5621E6EF93A2B4A716555F
SHA-256:	6F84D5D15A43AACF3EB98406A77B291E82CD29C902AEC8FD36C1EA6EBF2C70C1
SHA-512:	93F2EA01E5B1A4A02457EE2B5A1838A718A25CCBD3AF171AABEB9143496FD1388541C23B9D095F567642262AC39331406F1C97221CE102D956936CC1375E0AEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8b332e2c0ea845c799c54b03c2ca8ab7.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81830AvspL4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.369451035417761
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoPBvw6doQ2lsjs1Ha:SbFuFyLVIg1BG+f+MoPBvpdtZjoa
MD5:	B33F142126AD72E9E216014771C15DCC
SHA1:	E6B499D24D19A576295625751056B19AACF3E907
SHA-256:	F5EAAACC6FCB0308242820170A92DAE5BD7C983A7AE702F8B16E5F0B5ED80A3D
SHA-512:	D7562241B1926A6D30519048CC7D03812AD310083A252BA5AF460D72322B0E7A9ECD1837783719C2C09371C4366C912B6890BD06B0907AF6A66404F4BB288E1C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b161d5b9aa054408b5a15c8acbf472ec.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:818786GDtD7

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.317156386656119
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5tQ1HDg0MFrxsjshQ:SbFuFyLVIg1BG+f+MoxgX8jtWL0
MD5:	5F76A66A3E99DBCCC647DCDCE6FA724C
SHA1:	039C0B3DC26C3E323F735CBBDB06DF11F63AA241
SHA-256:	BDFDAA09306CBB57FB7B8E88314A34452AC41587412C49D528FE63258F432C05
SHA-512:	1B7D8EFC8DB45BE1FE73259C64DA880FDB17B2D078BE26DB796D0009757D7882C02AEFC97863C5AF0799CFF9D7E4B872F494022282E2F8E507AE6C1AB66354CE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3aa5668f40a7437aa757141ded07c85b.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:83010EReJp4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4329385413690865
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu5DEI5QE8Qo22jNE:qgFq6g10+f+MCDEqR8QojE
MD5:	587F24C41107A90E989EB36FB886D057
SHA1:	81D185A35609BAAA48C31F71E423A6DC228AF30F
SHA-256:	D1CD5E37DAA402DF8F161302C05E0AB863EC12763E79F40AD12C142C7E926A32
SHA-512:	DC962075137B0B9511C983F3A6194CFB5A611ED229D15B9FF937EBE6F6CA685A5313703E20AE565C3D936E584FB19ECC6E55DD7EBAC46AE96400B520EFF9E0ED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d3b9fe2660274bd898b88cd5aa0cb600.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/seats/.#seat01ksI5O

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat02FJ3vO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat055IT3v

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat08seDiw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0BgXfWj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0RHKRPN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0gxCHOw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0v0Dzzt

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/users/.#1271tKBBt

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290216046803941
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJg5SF2Kt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJg5SFDEthQHtPYqi
MD5:	407CBA91B1AB4A3E3CE5C82F7FA09695
SHA1:	2D3B812B8B3D85C8F4404FA0F1D40B0BF863CE3F
SHA-256:	F7292A6F78AA2789619C352F4C7D433D4255BE01A2A1B59325868DD97B30D111
SHA-512:	9623652EE5D53E2B41CF07BFCB0881EE2B39CD8B9E0307A02FE7BA6EB8C4A685831C41F12ED7549F56154C8C6C3555CA9A4454644F82B44262394FB8148ED9E3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733951573225755.MONOTONIC=479518429.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#12721sI7v

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30520031094998
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff84gN1w2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE4gPthQHtPYq9M
MD5:	659629E76CE05CB69FBEF0E438C18852
SHA1:	A8186660682A36A1CC8FC25E5BE6176DB2EB681C
SHA-256:	9755B56C9707594AAEAF92DCF2314A3E974ADD923C21E637F1F6DAB17950A1CC
SHA-512:	A77E78D1BC2F9C9C2D191DC134972C3199562CC4C57C1D31F4C4EE609396B61D2E66CF49E5750169F1B942BF731C3364F52382197634C56CC993465704842FE3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14621.REALTIME=1733951674005123.MONOTONIC=580297797.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#12732eTsM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2913181041500055
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffxrgPdW2nO02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBtgMAOPthQHtPYq9M
MD5:	11BCA859346DF08C16BD639591E0565C
SHA1:	5C91A5E6C5E837367512E23D4D177EB98C498CDB
SHA-256:	02AC61D204B17CA630AC63B193899BACDFCE1EF8C0354474406A3083BC1FB518
SHA-512:	8143617DE834B633F8CE8A912D6D3D158AD3D872FC79DBD674035E7C021C2D24F083B3AEA9D59D15A91B44502B5327675AEEF9F8791604293492CAD5A69AA086
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13822.REALTIME=1733951614919883.MONOTONIC=521212557.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1274HZEww

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30520031094998
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff84gN1w2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBE4gPthQHtPYq9M
MD5:	659629E76CE05CB69FBEF0E438C18852
SHA1:	A8186660682A36A1CC8FC25E5BE6176DB2EB681C
SHA-256:	9755B56C9707594AAEAF92DCF2314A3E974ADD923C21E637F1F6DAB17950A1CC
SHA-512:	A77E78D1BC2F9C9C2D191DC134972C3199562CC4C57C1D31F4C4EE609396B61D2E66CF49E5750169F1B942BF731C3364F52382197634C56CC993465704842FE3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14621.REALTIME=1733951674005123.MONOTONIC=580297797.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1275MrukL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.29155280217718
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGCLddWvOW1c1g206qodpOc7:SbFuFyL3BVgdL87iesnAiRJgPdW2n1g8
MD5:	509DF19A7D8AC5E5D44625E77DF6E141
SHA1:	39EC2C84905645C8D63A39184D2F30F99FD8797B
SHA-256:	76E8CDC82948218213D95ECA9C9303A2F4B7B5028A8E466463E8D8C226089AC3
SHA-512:	0F37E69BCA000A6D662385429D235B73027D7626D99DE8B2119FE6A67358CF7468F0C27F248327F9CA9A1D1E096B36535E25D11D727F361D2A38286DB1375349
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733951614919883.MONOTONIC=521212557.LAST_SESSION_TIMESTAMP=521296954.

/run/systemd/users/.#1277ehBXw

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.48620993646461
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8GgN1Dt6dS0v:qgFq30dABibBEGg/IdS0v
MD5:	B3B6E6754069051B98486D8C218109E6
SHA1:	DC66DF43B6B05BBE0C41A0824BFE9D938024156C
SHA-256:	A76215DF252FCE4C3D48D82E953EDC7492DFAFBF50926229E1F2175CD1D094DC
SHA-512:	DA48A4FD1D08BDFCFC6185E8D8C8EC79979CD15081433CCE906889B771CBC63C4C175C50C4016DD5ABD00F8A622B199C59E5B195AB68F17FCC0A137E4C7D0A00
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14803.REALTIME=1733951674005123.MONOTONIC=580297797.LAST_SESSION_TIMESTAMP=580377687.

/run/systemd/users/.#127IifPZv

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.32227106636078
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGC+Q5f9/+KD206qodjDS0v:SbFuFyL3BVgdL87iesnAiRJgN1Dt6dSW
MD5:	69AC9973DB70D74E795D264E1B191302
SHA1:	71F25FD8C5C672DD8580EF29D5BF77066A644751
SHA-256:	99853B7E1B5B01002A4B3FAAD861CB2D2CD213435377BEB4597E705DDA2139CD
SHA-512:	E2136EB6B131AF8623A7CA38B5E12E986D5B94FE26BB7C89C7B3DECD7371987BC56AAF831D172357F00164290F001B96CB2ED611DCDB0C9C601BB4F8369EF89E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733951674005123.MONOTONIC=580297797.LAST_SESSION_TIMESTAMP=580377687.

/run/systemd/users/.#127NbZSAu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.48620993646461
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8GgN1Dt6dS0v:qgFq30dABibBEGg/IdS0v
MD5:	B3B6E6754069051B98486D8C218109E6
SHA1:	DC66DF43B6B05BBE0C41A0824BFE9D938024156C
SHA-256:	A76215DF252FCE4C3D48D82E953EDC7492DFAFBF50926229E1F2175CD1D094DC
SHA-512:	DA48A4FD1D08BDFCFC6185E8D8C8EC79979CD15081433CCE906889B771CBC63C4C175C50C4016DD5ABD00F8A622B199C59E5B195AB68F17FCC0A137E4C7D0A00
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14803.REALTIME=1733951674005123.MONOTONIC=580297797.LAST_SESSION_TIMESTAMP=580377687.

/run/systemd/users/.#127UlWmEu

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127eD5wCt

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.303195512228691
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgGCzSFf+x4VvDi206qodKXcUH:SbFuFyL3BVgdL87iesnAiRJg5SF2Rt6q
MD5:	4383627CB0925A5574D0B02D30FCA631
SHA1:	491F69EA7D67FB70E4DF78995BFA2BF66C2B6010
SHA-256:	A36E280AD14DAED48AC99CB4EEFE19361C054C84FAB36B5F9B2A4F4A1C8C702D
SHA-512:	9FE0244DB97282615FD14AA3773B3C87AB14B588CEACAF5534EE9517B76093CEB7EF591D64ACFB25D0AA20846BD7551115C61C51EA4D3B715B4B15D7B62FBA5F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1733951573225755.MONOTONIC=479518429.LAST_SESSION_TIMESTAMP=479629188.

/run/systemd/users/.#127f3IVLs

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127frA2CK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127kCTAbt

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.290216046803941
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff6PJg5SF2Kt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBwJg5SFDEthQHtPYqi
MD5:	407CBA91B1AB4A3E3CE5C82F7FA09695
SHA1:	2D3B812B8B3D85C8F4404FA0F1D40B0BF863CE3F
SHA-256:	F7292A6F78AA2789619C352F4C7D433D4255BE01A2A1B59325868DD97B30D111
SHA-512:	9623652EE5D53E2B41CF07BFCB0881EE2B39CD8B9E0307A02FE7BA6EB8C4A685831C41F12ED7549F56154C8C6C3555CA9A4454644F82B44262394FB8148ED9E3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12347.REALTIME=1733951573225755.MONOTONIC=479518429.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127w4QiRN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.2913181041500055
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffxrgPdW2nO02thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBtgMAOPthQHtPYq9M
MD5:	11BCA859346DF08C16BD639591E0565C
SHA1:	5C91A5E6C5E837367512E23D4D177EB98C498CDB
SHA-256:	02AC61D204B17CA630AC63B193899BACDFCE1EF8C0354474406A3083BC1FB518
SHA-512:	8143617DE834B633F8CE8A912D6D3D158AD3D872FC79DBD674035E7C021C2D24F083B3AEA9D59D15A91B44502B5327675AEEF9F8791604293492CAD5A69AA086
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13822.REALTIME=1733951614919883.MONOTONIC=521212557.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127z4YMCN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.456657961281727
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixffd3g0JgPdW2n1gt6/:qgFq30dABibBV37gMAuI/
MD5:	56809BBDC3D04993449BD058FB6DDE2B
SHA1:	8B1EBCF666CFACA5DE6BC81091178AEE0AA97348
SHA-256:	EACE90C434A72D823227AB902AA11FC181D6719C87BE585EE471686AA894BBA6
SHA-512:	7A4E914DDC9249CBF57B53BE94B501596F830E83B2A21E6E01AA79A93EBDDFDC203E69489C641BE58FFAB08511DC45698ABF3869C7FA22375B9FBEA9BE18E581
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13884.REALTIME=1733951614919883.MONOTONIC=521212557.LAST_SESSION_TIMESTAMP=521296954.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:s:s
MD5:	36920578F5EFD6C5F54AFBCAE4694A1E
SHA1:	94D1B02B8457EE631D9F848AC73EA17C82E410F7
SHA-256:	9640860F81DF1E12F2768F7310B12614468C5F8EE8F24F5C9457B45D79F9F778
SHA-512:	D3ED1004E0C66F2CD8D468FCC6174FD72DDC2F19917F844D18B1454077F5C07BA412997C408107976DEC8FEE4BDAD6FADD1671F81CB6578E897FDFA6504C308D
Malicious:	false
Preview:	6472.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md6n:mcn
MD5:	228EC3F84A2F586D26F1FF886D27E667
SHA1:	21A871924871ADDB20DDBC9BB8350ED6C804D618
SHA-256:	FDD395567E91B5E9F982EC53F0D1C5F40A0867F3262A23B0EF9D1CE561E63AE3
SHA-512:	1CD47AAC39DE8A6BD9EC681FE957445FC10CF99728172941AFAE367502F41E3AB13EDE95D30ABA1D5B00DF08201DBFDE363F1F6B9CE64FFD33DC82E913D82FD1
Malicious:	false
Preview:	7085.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818555
Encrypted:	false
SSDEEP:	3:XCsXlXEWtl/BlCst:Xf+ylZlX
MD5:	94866FBF776D137248F85ECC240A13F3
SHA1:	907BCEFFE0633482D0F12D7CED72D99C8C880B59
SHA-256:	CF3E2369C7AC9FDEABCA1F82B27B07F89E85FC10DB5164CB06C283F29604E048
SHA-512:	CAA2353897071CA60A26725ACBEA2D912CC5222ED018C3F961FA02A370E5C9E389296691B85D35CBBB825E02FADDA393730BB511807E14B2A197E2FCD7D54624
Malicious:	false
Preview:	...._...tty2.tty2.......................tty2LOGIN..............................................................................................................................................................................................................................................................................................._.....Zg........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcUv:mcUv
MD5:	0BBD318DB9FA76653482084694D40297
SHA1:	104F7769C891E63003D2F94E1EF3B470A6C571A6
SHA-256:	DA7AD5C826751100FC009C6FE986A597805FCE6D19989C1C213D926580ED79F5
SHA-512:	F181CC64E5206C260EC0AE7ECE8584B00F0A425A6B5BFEEFF86C638455F9F844B5B8517FC1A087C1AD811E9E677FD3AF5DFCC57AFBC49E1C455F4AC648C11659
Malicious:	false
Preview:	7091.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md/n:mF
MD5:	148FB2B3EB9E60FD54A70E1AD8F16C3D
SHA1:	2A4126F009791D844DE4C6763D6CC0E0B3D7F0F4
SHA-256:	61A4DD5DD4DD0B53B7D771D65ECE3A9A521FE5FF108C7F74494B63A21A118716
SHA-512:	E81A3B090F61B7243030710699816C3D9C1C930C96E355BD845461972F0C02331E8F57CB0A403558E1F307DD1BE64E712608284952D62F3AEC44B4426E9DC47F
Malicious:	false
Preview:	7082.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mTj5t:mz
MD5:	FED38ADCEF793C6D919BB85FF48145BD
SHA1:	3F3570900EBE0B9884D83813FB3E0C468E482D32
SHA-256:	134E9B92D05D0C44CBFC90871266D6DA44C63FA590B046E0D13CAC731CD0E7F3
SHA-512:	51CD5988849BEFC2B25017E03CE2FB42C8DAD2DA76B61ECEEA41EECC8DA07424B2FDF3FFF926BFE3EB7AC4EB0A8C739BF347435CF4765D3D256C8635B0D965D4
Malicious:	false
Preview:	7067.7068.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md6n:mcn
MD5:	228EC3F84A2F586D26F1FF886D27E667
SHA1:	21A871924871ADDB20DDBC9BB8350ED6C804D618
SHA-256:	FDD395567E91B5E9F982EC53F0D1C5F40A0867F3262A23B0EF9D1CE561E63AE3
SHA-512:	1CD47AAC39DE8A6BD9EC681FE957445FC10CF99728172941AFAE367502F41E3AB13EDE95D30ABA1D5B00DF08201DBFDE363F1F6B9CE64FFD33DC82E913D82FD1
Malicious:	false
Preview:	7085.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcUv:mcUv
MD5:	0BBD318DB9FA76653482084694D40297
SHA1:	104F7769C891E63003D2F94E1EF3B470A6C571A6
SHA-256:	DA7AD5C826751100FC009C6FE986A597805FCE6D19989C1C213D926580ED79F5
SHA-512:	F181CC64E5206C260EC0AE7ECE8584B00F0A425A6B5BFEEFF86C638455F9F844B5B8517FC1A087C1AD811E9E677FD3AF5DFCC57AFBC49E1C455F4AC648C11659
Malicious:	false
Preview:	7091.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md/n:mF
MD5:	148FB2B3EB9E60FD54A70E1AD8F16C3D
SHA1:	2A4126F009791D844DE4C6763D6CC0E0B3D7F0F4
SHA-256:	61A4DD5DD4DD0B53B7D771D65ECE3A9A521FE5FF108C7F74494B63A21A118716
SHA-512:	E81A3B090F61B7243030710699816C3D9C1C930C96E355BD845461972F0C02331E8F57CB0A403558E1F307DD1BE64E712608284952D62F3AEC44B4426E9DC47F
Malicious:	false
Preview:	7082.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mTj5t:mz
MD5:	FED38ADCEF793C6D919BB85FF48145BD
SHA1:	3F3570900EBE0B9884D83813FB3E0C468E482D32
SHA-256:	134E9B92D05D0C44CBFC90871266D6DA44C63FA590B046E0D13CAC731CD0E7F3
SHA-512:	51CD5988849BEFC2B25017E03CE2FB42C8DAD2DA76B61ECEEA41EECC8DA07424B2FDF3FFF926BFE3EB7AC4EB0A8C739BF347435CF4765D3D256C8635B0D965D4
Malicious:	false
Preview:	7067.7068.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:md6n:mcn
MD5:	228EC3F84A2F586D26F1FF886D27E667
SHA1:	21A871924871ADDB20DDBC9BB8350ED6C804D618
SHA-256:	FDD395567E91B5E9F982EC53F0D1C5F40A0867F3262A23B0EF9D1CE561E63AE3
SHA-512:	1CD47AAC39DE8A6BD9EC681FE957445FC10CF99728172941AFAE367502F41E3AB13EDE95D30ABA1D5B00DF08201DBFDE363F1F6B9CE64FFD33DC82E913D82FD1
Malicious:	false
Preview:	7085.

/var/lib/AccountsService/users/gdm.6JWHY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.AG8BY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.E0MIY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.9076786264967245
Encrypted:	false
SSDEEP:	24:QUZeaE2GEu0v1FAvcFA2+VCjgWv20pYrMMJrM/KrCQU:Qv5fVMYrvrPrCn
MD5:	80CE0DD386CE899264F0C7BE12A2F1FA
SHA1:	1ECBF353B8661E3437EB408C57DB8EE4AFBAFCA3
SHA-256:	AFB5BA0E01B676BB9A1A27FDD2537F862B50CF4515EF345D74FB4F444A88FE63
SHA-512:	15416FF5363D21654E087F03D9BF00396DF8D048535AE0A91F85E096947F317AECCEF3CDCAEC564CFC659D73984706F669B4363C619DA569E6B4EE1C106312FD
Malicious:	false
Preview:	Dec 11 15:14:18 galassia systemd-logind[6947]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 11 15:14:18 galassia systemd-logind[6947]: User enumeration failed: Invalid argument.Dec 11 15:14:18 galassia systemd-logind[6947]: User of session 2 not known..Dec 11 15:14:18 galassia systemd-logind[6947]: Session enumeration failed: No such file or directory.Dec 11 15:14:18 galassia systemd-logind[6947]: Watching system buttons on /dev/input/event0 (Power Button).Dec 11 15:14:18 galassia systemd-logind[6947]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 11 15:14:18 galassia systemd-logind[6947]: New seat seat0..Dec 11 15:14:33 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 11 15:14:34 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 11 15:14:34 galassia systemd-logind[6947]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.459526019450492
Encrypted:	false
SSDEEP:	3:F31Hljw0h37B//Nw0h37x//l:F399Vn9F
MD5:	D901AFBD336F96DA06BC87F4D898AB5A
SHA1:	53E70141FAFE3CC6AE7CAE127D3D4255980A3386
SHA-256:	9404E5C970526FC1B8FEA775F9A3998299417DDD3D0D551058F525743C8ABF52
SHA-512:	03395BB737329B2C79F7B6CFF7922A787F7EFB4DC7D0AA4736D99C682B15141BB838CE0B15E3BB9F811CC2EE6827AEE5C9D55BE91571AA9E4C5D7FFFC55C860E
Malicious:	false
Preview:	LPKSHHRH..................U...D...k._v...................................U...D...k._v.........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4313806548581445
Encrypted:	false
SSDEEP:	3:F31Hle9p+Khcls9p+KhMl:F3g+ut+u
MD5:	7224E801000B2E7C93E27B888AB86681
SHA1:	1DC047758F55FB36F9C71D2E99B06DE965D115A2
SHA-256:	D2E9323DAA38D79DDE7CCC90BD24411D9479933159320BA2C0F3F2AB4CFE2FF5
SHA-512:	1DA018EF4213CD4BD9CFC7206C74F5E5A1726098DD53FB61478458818C6D96DD7231C835C9D3621F60463C9AC5FA0A366B6BC67498EAC002ED8FFCE4B6CBB21D
Malicious:	false
Preview:	LPKSHHRH..................^&..L.....&%....................................^&..L.....&%..........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12147
Entropy (8bit):	4.939284478101421
Encrypted:	false
SSDEEP:	96:nSiF8Pr9vwpVePSubpA2BIq3GxEC6YUf/FdTRlLD9Te3cnbw7fzDSmuDZ6jNj7gL:nSMkf7XElaKRosr8Dn4T7+ZJG6r2P0
MD5:	9F68AF5719107B7F3B676BE8A80084BF
SHA1:	8750F4D4E868B89ADDD59CE2BFC32A77A6E49E50
SHA-256:	E3579EF8AE65332C80D7C5B2BDCD870E12C1B27209B55DD521D767376488D93C
SHA-512:	AC88A3BAC9CF6438ED4E144A7E6F37B7747D074769A17E46975758E391B37F874D54DF8481FC1B08AACF3B16145F6401A61E47B011B139F069EB5D14D87ED08D
Malicious:	false
Preview:	Dec 11 15:14:10 galassia kernel: [ 555.208806] New task spawned: old: (tgid 6939, tid 6939), new (tgid: 6939, tid: 6941).Dec 11 15:14:10 galassia kernel: [ 556.055010] blocking signal 9: 6222 -> 658.Dec 11 15:14:10 galassia kernel: [ 556.061086] blocking signal 9: 6222 -> 720.Dec 11 15:14:10 galassia kernel: [ 556.067024] blocking signal 9: 6222 -> 772.Dec 11 15:14:10 galassia kernel: [ 556.079189] blocking signal 9: 6222 -> 936.Dec 11 15:14:10 galassia kernel: [ 556.084684] blocking signal 9: 6222 -> 2048.Dec 11 15:14:10 galassia kernel: [ 556.819926] New task spawned: old: (tgid 7005, tid 7005), new (tgid: 7005, tid: 7009).Dec 11 15:14:10 galassia kernel: [ 556.869912] New task spawned: old: (tgid 7008, tid 7008), new (tgid: 7008, tid: 7010).Dec 11 15:14:10 galassia kernel: [ 556.870758] New task spawned: old: (tgid 7008, tid 7008), new (tgid: 7008, tid: 7011).Dec 11 15:14:10 galassia kernel: [ 556.874943] New task spawned: old: (tgid 7008, tid 7010), new (tgid: 7008, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	30374
Entropy (8bit):	5.077815424543206
Encrypted:	false
SSDEEP:	768:oTINZXbNZX8Ev7p20gyV78oG1RWCstazqmED2a4EaeQHBFr0CeAv5Fbn1Bzr:S2CZ
MD5:	A36C8A35B7E59A1D1563DCDFD9D7707A
SHA1:	FD6848105445E8903E4505EC2981EF75ABE66F0C
SHA-256:	7CE66499291AF996128D822C0EF194217CCCAFF49FB39425C525A0BBCCDD7C63
SHA-512:	5E424385974D7487BFDAB185FE2B09982B48AC38A2561249F86FCA2F32DAD7D3CADE1A8AD9BD8F7FC5DF6707819C7720767FD157D73306ED64F02325FD3AC81D
Malicious:	false
Preview:	Dec 11 15:14:09 galassia systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 11 15:14:10 galassia kernel: [ 555.208806] New task spawned: old: (tgid 6939, tid 6939), new (tgid: 6939, tid: 6941).Dec 11 15:14:10 galassia kernel: [ 555.672101] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 11 15:14:10 galassia kernel: [ 555.672114] systemd[1]: Stopped Journal Service..Dec 11 15:14:10 galassia kernel: [ 555.673111] systemd[1]: Starting Journal Service....Dec 11 15:14:10 galassia kernel: [ 555.696313] systemd[1]: systemd-logind.service: Main process exited, code=killed, status=9/KILL.Dec 11 15:14:10 galassia kernel: [ 555.696376] systemd[1]: systemd-logind.service: Failed with result 'signal'..Dec 11 15:14:10 galassia kernel: [ 555.696893] systemd[1]: systemd-logind.service: Scheduled restart job, restart counter is at 5..Dec 11 15:14:10 galassia kernel: [ 555.696899] systemd[1]: Stopped Login Service..Dec 11 15:14

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818555
Encrypted:	false
SSDEEP:	3:XCsXlXEWtl/BlCst:Xf+ylZlX
MD5:	94866FBF776D137248F85ECC240A13F3
SHA1:	907BCEFFE0633482D0F12D7CED72D99C8C880B59
SHA-256:	CF3E2369C7AC9FDEABCA1F82B27B07F89E85FC10DB5164CB06C283F29604E048
SHA-512:	CAA2353897071CA60A26725ACBEA2D912CC5222ED018C3F961FA02A370E5C9E389296691B85D35CBBB825E02FADDA393730BB511807E14B2A197E2FCD7D54624
Malicious:	true
Preview:	...._...tty2.tty2.......................tty2LOGIN..............................................................................................................................................................................................................................................................................................._.....Zg........................................

Source: global traffic	TCP traffic: 192.168.2.23:52668 -> 178.215.238.4:33966
Source: global traffic	TCP traffic: 192.168.2.23:50014 -> 89.190.156.145:7733

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.866549382083989
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	vwkjebwi686.elf
File size:	123'052 bytes
MD5:	b8fd0206e3798742e76dbed9bc97c57c
SHA1:	489746eb51ff7df99090f11566bb739902d6d3c3
SHA256:	75df4b4cd3628d5e1eb4360fdb28446d3922f68cab867567352a55d37072c32c
SHA512:	2b5eb62fdf6403c650cfd50022f12152f6a2748960b74334622cdaf290232aee12a7256eab8ca7ad5f681b2716a29f094bbacca7494fd20ee0e71ac886dfc3b1
SSDEEP:	3072:jHBsZwOiu/uC70mcQrK6d8tkLtyRTElzcytP:jHBsZwOiu/uzmcQrDxNtP
TLSH:	ACC348C4FA4BC1F5D8930830506BF73FCB31D0695125EA2EEFA99E32DE63542920A758
File Content Preview:	.ELF....................h...4...........4. ...(.....................S...S...............X...X'..X'...G..............Q.td............................U..S............h.....j..[]...$.............U......=.n...t..1.....'......'......u........t...$T...........n

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x8048168
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	122652
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x8048094	0x94	0x1c	0x0	0x6	AX	1
.text	PROGBITS	0x80480b0	0xb0	0x16a41	0x0	0x6	AX	16
.fini	PROGBITS	0x805eaf1	0x16af1	0x17	0x0	0x6	AX	1
.rodata	PROGBITS	0x805eb20	0x16b20	0x2c33	0x0	0x2	A	32
.ctors	PROGBITS	0x8062758	0x19758	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x8062764	0x19764	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x8062780	0x19780	0x475c	0x0	0x3	WA	32
.bss	NOBITS	0x8066ee0	0x1dedc	0x492c	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x1dedc	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x8048000	0x8048000	0x19753	0x19753	6.4641	0x5	R E	0x1000	.init .text .fini .rodata
LOAD	0x19758	0x8062758	0x8062758	0x4784	0x90b4	0.3752	0x6	RW	0x1000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 11, 2024 22:12:52.670603991 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 11, 2024 22:14:12.694375992 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 11, 2024 22:11:45.136378050 CET	192.168.2.23	8.8.8.8	0x128d	Standard query (0)	raw.cardiacpure.ru	A (IP address)	IN (0x0001)	false
Dec 11, 2024 22:11:45.401144028 CET	192.168.2.23	8.8.8.8	0xc0be	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 11, 2024 22:11:45.524893045 CET	192.168.2.23	8.8.8.8	0xc0be	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 11, 2024 22:11:45.651048899 CET	192.168.2.23	8.8.8.8	0xc0be	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 11, 2024 22:11:45.774241924 CET	192.168.2.23	8.8.8.8	0xc0be	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	273	false
Dec 11, 2024 22:11:45.897241116 CET	192.168.2.23	8.8.8.8	0xc0be	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	274	false
Dec 11, 2024 22:11:48.033999920 CET	192.168.2.23	8.8.8.8	0x65d3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 22:11:48.156517029 CET	192.168.2.23	8.8.8.8	0x65d3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 22:11:48.279270887 CET	192.168.2.23	8.8.8.8	0x65d3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 22:11:48.401829004 CET	192.168.2.23	8.8.8.8	0x65d3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 22:11:48.526669025 CET	192.168.2.23	8.8.8.8	0x65d3	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	276	false
Dec 11, 2024 22:11:50.668212891 CET	192.168.2.23	8.8.8.8	0x2bc2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	278	false
Dec 11, 2024 22:11:50.795213938 CET	192.168.2.23	8.8.8.8	0x2bc2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	278	false
Dec 11, 2024 22:11:50.920005083 CET	192.168.2.23	8.8.8.8	0x2bc2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	278	false
Dec 11, 2024 22:11:51.044044971 CET	192.168.2.23	8.8.8.8	0x2bc2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 11, 2024 22:11:51.169312954 CET	192.168.2.23	8.8.8.8	0x2bc2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	279	false
Dec 11, 2024 22:11:53.301403046 CET	192.168.2.23	8.8.8.8	0x186	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 11, 2024 22:11:53.427437067 CET	192.168.2.23	8.8.8.8	0x186	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 11, 2024 22:11:53.550782919 CET	192.168.2.23	8.8.8.8	0x186	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 11, 2024 22:11:53.674375057 CET	192.168.2.23	8.8.8.8	0x186	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 11, 2024 22:11:53.797736883 CET	192.168.2.23	8.8.8.8	0x186	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	281	false
Dec 11, 2024 22:11:55.946073055 CET	192.168.2.23	8.8.8.8	0xdfea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 22:11:56.069361925 CET	192.168.2.23	8.8.8.8	0xdfea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 22:11:56.192992926 CET	192.168.2.23	8.8.8.8	0xdfea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 22:11:56.315778971 CET	192.168.2.23	8.8.8.8	0xdfea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 22:11:56.438587904 CET	192.168.2.23	8.8.8.8	0xdfea	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	284	false
Dec 11, 2024 22:11:58.583183050 CET	192.168.2.23	8.8.8.8	0x63d2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 11, 2024 22:11:58.706058979 CET	192.168.2.23	8.8.8.8	0x63d2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 11, 2024 22:11:58.829093933 CET	192.168.2.23	8.8.8.8	0x63d2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 11, 2024 22:11:58.956459999 CET	192.168.2.23	8.8.8.8	0x63d2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	286	false
Dec 11, 2024 22:11:59.079138041 CET	192.168.2.23	8.8.8.8	0x63d2	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	287	false
Dec 11, 2024 22:12:35.307996988 CET	192.168.2.23	1.1.1.1	0xc60d	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 22:12:35.308072090 CET	192.168.2.23	1.1.1.1	0x1ad	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 22:12:36.751059055 CET	192.168.2.23	1.1.1.1	0xd7ad	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 22:13:00.234358072 CET	192.168.2.23	1.1.1.1	0xd937	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 22:13:05.431905985 CET	192.168.2.23	8.8.8.8	0xb1d0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	353	false
Dec 11, 2024 22:13:05.554697037 CET	192.168.2.23	8.8.8.8	0xb1d0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	353	false
Dec 11, 2024 22:13:05.679559946 CET	192.168.2.23	8.8.8.8	0xb1d0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	353	false
Dec 11, 2024 22:13:05.802015066 CET	192.168.2.23	8.8.8.8	0xb1d0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	353	false
Dec 11, 2024 22:13:05.925409079 CET	192.168.2.23	8.8.8.8	0xb1d0	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	353	false
Dec 11, 2024 22:13:08.058265924 CET	192.168.2.23	8.8.8.8	0xfef7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	356	false
Dec 11, 2024 22:13:08.182435989 CET	192.168.2.23	8.8.8.8	0xfef7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	356	false
Dec 11, 2024 22:13:08.306154013 CET	192.168.2.23	8.8.8.8	0xfef7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	356	false
Dec 11, 2024 22:13:08.434442043 CET	192.168.2.23	8.8.8.8	0xfef7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	356	false
Dec 11, 2024 22:13:08.561384916 CET	192.168.2.23	8.8.8.8	0xfef7	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	356	false
Dec 11, 2024 22:13:10.326940060 CET	192.168.2.23	1.1.1.1	0x1438	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 22:13:10.720854998 CET	192.168.2.23	8.8.8.8	0xe04b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	358	false
Dec 11, 2024 22:13:10.843323946 CET	192.168.2.23	8.8.8.8	0xe04b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	358	false
Dec 11, 2024 22:13:10.967763901 CET	192.168.2.23	8.8.8.8	0xe04b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	358	false
Dec 11, 2024 22:13:11.094412088 CET	192.168.2.23	8.8.8.8	0xe04b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	359	false
Dec 11, 2024 22:13:11.221390009 CET	192.168.2.23	8.8.8.8	0xe04b	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	359	false
Dec 11, 2024 22:13:13.352659941 CET	192.168.2.23	8.8.8.8	0xf30e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 11, 2024 22:13:13.475224018 CET	192.168.2.23	8.8.8.8	0xf30e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 11, 2024 22:13:13.597662926 CET	192.168.2.23	8.8.8.8	0xf30e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 11, 2024 22:13:13.720145941 CET	192.168.2.23	8.8.8.8	0xf30e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 11, 2024 22:13:13.842483997 CET	192.168.2.23	8.8.8.8	0xf30e	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	361	false
Dec 11, 2024 22:13:15.444144964 CET	192.168.2.23	1.1.1.1	0x7c5b	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 22:13:15.971287966 CET	192.168.2.23	8.8.8.8	0x3aba	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 11, 2024 22:13:16.094706059 CET	192.168.2.23	8.8.8.8	0x3aba	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 11, 2024 22:13:16.217443943 CET	192.168.2.23	8.8.8.8	0x3aba	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 11, 2024 22:13:16.340332985 CET	192.168.2.23	8.8.8.8	0x3aba	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 11, 2024 22:13:16.462641001 CET	192.168.2.23	8.8.8.8	0x3aba	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	364	false
Dec 11, 2024 22:13:18.584204912 CET	192.168.2.23	8.8.8.8	0x696a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	366	false
Dec 11, 2024 22:13:18.706701994 CET	192.168.2.23	8.8.8.8	0x696a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	366	false
Dec 11, 2024 22:13:18.829761028 CET	192.168.2.23	8.8.8.8	0x696a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	366	false
Dec 11, 2024 22:13:18.953861952 CET	192.168.2.23	8.8.8.8	0x696a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	367	false
Dec 11, 2024 22:13:19.076425076 CET	192.168.2.23	8.8.8.8	0x696a	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	367	false
Dec 11, 2024 22:13:21.205924034 CET	192.168.2.23	8.8.8.8	0xfc62	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 11, 2024 22:13:21.328469038 CET	192.168.2.23	8.8.8.8	0xfc62	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 11, 2024 22:13:21.451297998 CET	192.168.2.23	8.8.8.8	0xfc62	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 11, 2024 22:13:21.573596001 CET	192.168.2.23	8.8.8.8	0xfc62	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 11, 2024 22:13:21.696005106 CET	192.168.2.23	8.8.8.8	0xfc62	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	369	false
Dec 11, 2024 22:13:23.818979025 CET	192.168.2.23	8.8.8.8	0x146f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	371	false
Dec 11, 2024 22:13:23.941831112 CET	192.168.2.23	8.8.8.8	0x146f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	372	false
Dec 11, 2024 22:13:24.064449072 CET	192.168.2.23	8.8.8.8	0x146f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	372	false
Dec 11, 2024 22:13:24.186934948 CET	192.168.2.23	8.8.8.8	0x146f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	372	false
Dec 11, 2024 22:13:24.309478998 CET	192.168.2.23	8.8.8.8	0x146f	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	372	false
Dec 11, 2024 22:13:26.442368031 CET	192.168.2.23	8.8.8.8	0x9277	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	374	false
Dec 11, 2024 22:13:26.565974951 CET	192.168.2.23	8.8.8.8	0x9277	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	374	false
Dec 11, 2024 22:13:26.690785885 CET	192.168.2.23	8.8.8.8	0x9277	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	374	false
Dec 11, 2024 22:13:26.814285994 CET	192.168.2.23	8.8.8.8	0x9277	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	374	false
Dec 11, 2024 22:13:26.938970089 CET	192.168.2.23	8.8.8.8	0x9277	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	374	false
Dec 11, 2024 22:13:29.077730894 CET	192.168.2.23	8.8.8.8	0x138	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	377	false
Dec 11, 2024 22:13:29.205480099 CET	192.168.2.23	8.8.8.8	0x138	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	377	false
Dec 11, 2024 22:13:29.329777956 CET	192.168.2.23	8.8.8.8	0x138	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	377	false
Dec 11, 2024 22:13:29.452994108 CET	192.168.2.23	8.8.8.8	0x138	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	377	false
Dec 11, 2024 22:13:29.575824976 CET	192.168.2.23	8.8.8.8	0x138	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	377	false
Dec 11, 2024 22:13:31.710336924 CET	192.168.2.23	8.8.8.8	0x7170	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Dec 11, 2024 22:13:31.833425045 CET	192.168.2.23	8.8.8.8	0x7170	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Dec 11, 2024 22:13:31.959825993 CET	192.168.2.23	8.8.8.8	0x7170	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	379	false
Dec 11, 2024 22:13:32.086545944 CET	192.168.2.23	8.8.8.8	0x7170	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	380	false
Dec 11, 2024 22:13:32.209737062 CET	192.168.2.23	8.8.8.8	0x7170	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	380	false
Dec 11, 2024 22:13:34.363424063 CET	192.168.2.23	8.8.8.8	0xde15	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Dec 11, 2024 22:13:34.488219023 CET	192.168.2.23	8.8.8.8	0xde15	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Dec 11, 2024 22:13:34.613823891 CET	192.168.2.23	8.8.8.8	0xde15	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Dec 11, 2024 22:13:34.737185955 CET	192.168.2.23	8.8.8.8	0xde15	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Dec 11, 2024 22:13:34.859616041 CET	192.168.2.23	8.8.8.8	0xde15	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	382	false
Dec 11, 2024 22:13:37.078310966 CET	192.168.2.23	8.8.8.8	0x6777	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	385	false
Dec 11, 2024 22:13:37.204766035 CET	192.168.2.23	8.8.8.8	0x6777	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	385	false
Dec 11, 2024 22:13:37.327369928 CET	192.168.2.23	8.8.8.8	0x6777	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	385	false
Dec 11, 2024 22:13:37.451448917 CET	192.168.2.23	8.8.8.8	0x6777	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	385	false
Dec 11, 2024 22:13:37.573970079 CET	192.168.2.23	8.8.8.8	0x6777	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	385	false
Dec 11, 2024 22:14:13.719432116 CET	192.168.2.23	1.1.1.1	0xe8a0	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 11, 2024 22:14:13.719476938 CET	192.168.2.23	1.1.1.1	0x8b5e	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 11, 2024 22:15:05.453533888 CET	192.168.2.23	8.8.8.8	0x21ef	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	473	false
Dec 11, 2024 22:15:05.581918001 CET	192.168.2.23	8.8.8.8	0x21ef	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	473	false
Dec 11, 2024 22:15:05.704911947 CET	192.168.2.23	8.8.8.8	0x21ef	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	473	false
Dec 11, 2024 22:15:05.829210043 CET	192.168.2.23	8.8.8.8	0x21ef	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	473	false
Dec 11, 2024 22:15:05.951694965 CET	192.168.2.23	8.8.8.8	0x21ef	Standard query (0)	raw.cardiacpure.ru. [malformed]	256	474	false

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 11, 2024 22:11:45.400897980 CET	8.8.8.8	192.168.2.23	0x128d	No error (0)	raw.cardiacpure.ru	178.215.238.4	A (IP address)	IN (0x0001)	false
Dec 11, 2024 22:12:35.529807091 CET	1.1.1.1	192.168.2.23	0xc60d	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 11, 2024 22:12:35.529807091 CET	1.1.1.1	192.168.2.23	0xc60d	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 11, 2024 22:14:13.950416088 CET	1.1.1.1	192.168.2.23	0xe8a0	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 11, 2024 22:14:13.950416088 CET	1.1.1.1	192.168.2.23	0xe8a0	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-11 21:12:41 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-11 21:12:42 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-11 21:12:42 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-11 21:12:43 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Wed, 11 Dec 2024 21:12:43 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	21:11:44
Start date (UTC):	11/12/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	/tmp/vwkjebwi686.elf
File size:	123052 bytes
MD5 hash:	b8fd0206e3798742e76dbed9bc97c57c

Start time (UTC):	21:11:47
Start date (UTC):	11/12/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	-
File size:	123052 bytes
MD5 hash:	b8fd0206e3798742e76dbed9bc97c57c

Start time (UTC):	21:13:15
Start date (UTC):	11/12/2024
Path:	/tmp/vwkjebwi686.elf
Arguments:	-
File size:	123052 bytes
MD5 hash:	b8fd0206e3798742e76dbed9bc97c57c

Start time (UTC):	21:11:45
Start date (UTC):	11/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	21:11:46
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:26
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:29
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:31
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:32
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:34
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:35
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report vwkjebwi686.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6917/oom_score_adj

/proc/7076/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:4089886SIkrci

/run/systemd/journal/streams/.#9:4089899E74aZi

/run/systemd/journal/streams/.#9:4089901HSc7Ji

/run/systemd/journal/streams/.#9:4090083WH1qAf

/run/systemd/journal/streams/.#9:4090131tT7tKf

/run/systemd/journal/streams/.#9:4090239frJQLi

/run/systemd/journal/streams/.#9:4090379doNjtf

/run/systemd/journal/streams/.#9:666070qFXYIg

/run/systemd/journal/streams/.#9:666071K2ESxi

/run/systemd/journal/streams/.#9:666072Qi4iQe

/run/systemd/journal/streams/.#9:666073BBoAVh

/run/systemd/journal/streams/.#9:666080SZ2Hvf

/run/systemd/journal/streams/.#9:666089nJwi3i

/run/systemd/journal/streams/.#9:666186in2Cci

/run/systemd/journal/streams/.#9:666265rHMqSg

/run/systemd/journal/streams/.#9:666365i86Mtf

/run/systemd/journal/streams/.#9:666471xNaI1e

/run/systemd/journal/streams/.#9:666517XGjcag

/run/systemd/journal/streams/.#9:6665195PMvNh

/run/systemd/journal/streams/.#9:75444cLFyfI

Linux Analysis Report
vwkjebwi686.elf

Start time (UTC):	21:12:36
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	21:12:37
Start date (UTC):	11/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:12:38
Start date (UTC):	11/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	21:12:41
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:39
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:40
Start date (UTC):	11/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:12:50
Start date (UTC):	11/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:12:51
Start date (UTC):	11/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	21:12:53
Start date (UTC):	11/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	21:12:54
Start date (UTC):	11/12/2024
Path:	/usr/lib/gdm3/gdm-wayland-session
Arguments:	-
File size:	76368 bytes
MD5 hash:	d3def63cf1e83f7fb8a0f13b1744ff7c