Edit tour

Linux Analysis Report
wrjkngh4.elf

Overview

General Information

Sample name:	wrjkngh4.elf
Analysis ID:	1578480
MD5:	820dac361dea90d7449d2a86e75ab92b
SHA1:	4775a5d3f3ef2b55211896d3a4dbebd78574b0e7
SHA256:	251cd8966aec6f6576dee6948760642c2dfe4f23f570d022ff6846af35ff09ce
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578480
Start date and time:	2024-12-19 19:42:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wrjkngh4.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/145@199/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: wrjkngh4.elf

Runtime Messages

Command:	/tmp/wrjkngh4.elf
PID:	6226
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6212, Parent: 4331)

rm (PID: 6212, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.IYrpCRxer1 /tmp/tmp.dBC8wYrP8L /tmp/tmp.bpwRrm2oKR

dash New Fork (PID: 6213, Parent: 4331)

rm (PID: 6213, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.IYrpCRxer1 /tmp/tmp.dBC8wYrP8L /tmp/tmp.bpwRrm2oKR

wrjkngh4.elf (PID: 6226, Parent: 6144, MD5: 8943e5f8f8c280467b4472c15ae93ba9) Arguments: /tmp/wrjkngh4.elf

wrjkngh4.elf New Fork (PID: 6228, Parent: 6226)

wrjkngh4.elf New Fork (PID: 6230, Parent: 6228)

wrjkngh4.elf New Fork (PID: 6390, Parent: 6230)

sh (PID: 6390, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6396, Parent: 6390)

ps (PID: 6396, Parent: 6390, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

wrjkngh4.elf New Fork (PID: 6878, Parent: 6230)

sh (PID: 6878, Parent: 6230, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6880, Parent: 6878)

ps (PID: 6880, Parent: 6878, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6232, Parent: 1477)

sh (PID: 6232, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6232, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6237, Parent: 1)

systemd-hostnamed (PID: 6237, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6385, Parent: 1320)

Default (PID: 6385, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6389, Parent: 1320)

Default (PID: 6389, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6452, Parent: 1)

journalctl (PID: 6452, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6466, Parent: 1)

systemd-journald (PID: 6466, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6472, Parent: 1)

journalctl (PID: 6472, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6491, Parent: 1)

dbus-daemon (PID: 6491, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6495, Parent: 1860)

pulseaudio (PID: 6495, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6496, Parent: 1)

rsyslogd (PID: 6496, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6504, Parent: 1)

rtkit-daemon (PID: 6504, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6507, Parent: 1)

systemd-logind (PID: 6507, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6569, Parent: 1)

polkitd (PID: 6569, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6574, Parent: 1)

agetty (PID: 6574, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6576, Parent: 1320)

Default (PID: 6576, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6577, Parent: 1)

gpu-manager (PID: 6577, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6578, Parent: 6577)

sh (PID: 6578, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6579, Parent: 6578)

grep (PID: 6579, Parent: 6578, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6580, Parent: 6577)

sh (PID: 6580, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6581, Parent: 6580)

grep (PID: 6581, Parent: 6580, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6585, Parent: 6577)

sh (PID: 6585, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6586, Parent: 6585)

grep (PID: 6586, Parent: 6585, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6590, Parent: 6577)

sh (PID: 6590, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6591, Parent: 6590)

grep (PID: 6591, Parent: 6590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6593, Parent: 6577)

sh (PID: 6593, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6594, Parent: 6593)

grep (PID: 6594, Parent: 6593, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6595, Parent: 6577)

sh (PID: 6595, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6595)

grep (PID: 6596, Parent: 6595, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6598, Parent: 6577)

sh (PID: 6598, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6599, Parent: 6598)

grep (PID: 6599, Parent: 6598, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6600, Parent: 6577)

sh (PID: 6600, Parent: 6577, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6601, Parent: 6600)

grep (PID: 6601, Parent: 6600, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gvfsd-fuse New Fork (PID: 6584, Parent: 2038)

fusermount (PID: 6584, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6602, Parent: 1)

generate-config (PID: 6602, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6603, Parent: 6602)

pkill (PID: 6603, Parent: 6602, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6604, Parent: 1)

gdm-wait-for-drm (PID: 6604, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6610, Parent: 1)

gdm3 (PID: 6610, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6613, Parent: 6610)

plymouth (PID: 6613, Parent: 6610, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6625, Parent: 6610)

gdm-session-worker (PID: 6625, Parent: 6610, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm3 New Fork (PID: 6629, Parent: 6610)

Default (PID: 6629, Parent: 6610, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6630, Parent: 6610)

Default (PID: 6630, Parent: 6610, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6614, Parent: 1)

accounts-daemon (PID: 6614, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6618, Parent: 6614)

language-validate (PID: 6618, Parent: 6614, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6619, Parent: 6618)

language-options (PID: 6619, Parent: 6618, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6620, Parent: 6619)

sh (PID: 6620, Parent: 6619, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6621, Parent: 6620)

locale (PID: 6621, Parent: 6620, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6622, Parent: 6620)

grep (PID: 6622, Parent: 6620, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6632, Parent: 1)

rsyslogd (PID: 6632, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6633, Parent: 1)

agetty (PID: 6633, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6638, Parent: 1)

dbus-daemon (PID: 6638, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6639, Parent: 1)

gpu-manager (PID: 6639, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6640, Parent: 6639)

sh (PID: 6640, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6641, Parent: 6640)

grep (PID: 6641, Parent: 6640, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6642, Parent: 6639)

sh (PID: 6642, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6643, Parent: 6642)

grep (PID: 6643, Parent: 6642, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6704, Parent: 6639)

sh (PID: 6704, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6705, Parent: 6704)

grep (PID: 6705, Parent: 6704, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6707, Parent: 6639)

sh (PID: 6707, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6708, Parent: 6707)

grep (PID: 6708, Parent: 6707, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6709, Parent: 6639)

sh (PID: 6709, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6710, Parent: 6709)

grep (PID: 6710, Parent: 6709, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6711, Parent: 6639)

sh (PID: 6711, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6712, Parent: 6711)

grep (PID: 6712, Parent: 6711, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6715, Parent: 6639)

sh (PID: 6715, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6716, Parent: 6715)

grep (PID: 6716, Parent: 6715, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6717, Parent: 6639)

sh (PID: 6717, Parent: 6639, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6718, Parent: 6717)

grep (PID: 6718, Parent: 6717, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6647, Parent: 1)

systemd-logind (PID: 6647, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6719, Parent: 1)

generate-config (PID: 6719, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6720, Parent: 6719)

pkill (PID: 6720, Parent: 6719, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6721, Parent: 1)

gdm-wait-for-drm (PID: 6721, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6726, Parent: 1)

rsyslogd (PID: 6726, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6735, Parent: 1)

dbus-daemon (PID: 6735, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6739, Parent: 1)

systemd-logind (PID: 6739, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6797, Parent: 1)

journalctl (PID: 6797, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6798, Parent: 1)

systemd-journald (PID: 6798, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6799, Parent: 1)

agetty (PID: 6799, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6802, Parent: 1)

rsyslogd (PID: 6802, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6805, Parent: 1)

systemd-logind (PID: 6805, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6862, Parent: 1)

gpu-manager (PID: 6862, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6863, Parent: 6862)

sh (PID: 6863, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6867, Parent: 6863)

grep (PID: 6867, Parent: 6863, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6868, Parent: 6862)

sh (PID: 6868, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6869, Parent: 6868)

grep (PID: 6869, Parent: 6868, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6870, Parent: 6862)

sh (PID: 6870, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6871, Parent: 6870)

grep (PID: 6871, Parent: 6870, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6872, Parent: 6862)

sh (PID: 6872, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6873, Parent: 6872)

grep (PID: 6873, Parent: 6872, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6874, Parent: 6862)

sh (PID: 6874, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6875, Parent: 6874)

grep (PID: 6875, Parent: 6874, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6876, Parent: 6862)

sh (PID: 6876, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6877, Parent: 6876)

grep (PID: 6877, Parent: 6876, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6881, Parent: 6862)

sh (PID: 6881, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6882, Parent: 6881)

grep (PID: 6882, Parent: 6881, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6883, Parent: 6862)

sh (PID: 6883, Parent: 6862, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6884, Parent: 6883)

grep (PID: 6884, Parent: 6883, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6887, Parent: 1)

generate-config (PID: 6887, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6888, Parent: 6887)

pkill (PID: 6888, Parent: 6887, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6889, Parent: 1)

journalctl (PID: 6889, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6891, Parent: 1)

gdm-wait-for-drm (PID: 6891, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6896, Parent: 1)

gdm3 (PID: 6896, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6899, Parent: 6896)

plymouth (PID: 6899, Parent: 6896, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6915, Parent: 6896)

gdm-session-worker (PID: 6915, Parent: 6896, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6919, Parent: 6915)

gdm-wayland-session (PID: 6919, Parent: 6915, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6921, Parent: 6919)

dbus-daemon (PID: 6921, Parent: 6919, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6923, Parent: 6921)

dbus-daemon New Fork (PID: 6924, Parent: 6923)

false (PID: 6924, Parent: 6923, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6925, Parent: 6919)

dbus-run-session (PID: 6925, Parent: 6919, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6926, Parent: 6925)

dbus-daemon (PID: 6926, Parent: 6925, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6927, Parent: 6896)

Default (PID: 6927, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6928, Parent: 6896)

Default (PID: 6928, Parent: 6896, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6900, Parent: 1)

accounts-daemon (PID: 6900, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6904, Parent: 6900)

language-validate (PID: 6904, Parent: 6900, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6905, Parent: 6904)

language-options (PID: 6905, Parent: 6904, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6906, Parent: 6905)

sh (PID: 6906, Parent: 6905, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6907, Parent: 6906)

locale (PID: 6907, Parent: 6906, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6908, Parent: 6906)

grep (PID: 6908, Parent: 6906, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6911, Parent: 1)

polkitd (PID: 6911, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6943, Parent: 1)

journalctl (PID: 6943, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6944, Parent: 1)

dbus-daemon (PID: 6944, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6945, Parent: 1)

agetty (PID: 6945, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6948, Parent: 1)

systemd-logind (PID: 6948, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6954, Parent: 1)

systemd-journald (PID: 6954, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6963, Parent: 1)

dbus-daemon (PID: 6963, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7005, Parent: 1)

rsyslogd (PID: 7005, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7013, Parent: 1)

gpu-manager (PID: 7013, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7020, Parent: 7013)

sh (PID: 7020, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7021, Parent: 7020)

grep (PID: 7021, Parent: 7020, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7022, Parent: 7013)

sh (PID: 7022, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7023, Parent: 7022)

grep (PID: 7023, Parent: 7022, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7024, Parent: 7013)

sh (PID: 7024, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7025, Parent: 7024)

grep (PID: 7025, Parent: 7024, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7028, Parent: 7013)

sh (PID: 7028, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7030, Parent: 7028)

grep (PID: 7030, Parent: 7028, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7035, Parent: 7013)

sh (PID: 7035, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7038, Parent: 7035)

grep (PID: 7038, Parent: 7035, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7040, Parent: 7013)

sh (PID: 7040, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7041, Parent: 7040)

grep (PID: 7041, Parent: 7040, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7044, Parent: 7013)

sh (PID: 7044, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7045, Parent: 7044)

grep (PID: 7045, Parent: 7044, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7046, Parent: 7013)

sh (PID: 7046, Parent: 7013, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7047, Parent: 7046)

grep (PID: 7047, Parent: 7046, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7018, Parent: 1860)

dbus-daemon (PID: 7018, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7019, Parent: 1860)

pulseaudio (PID: 7019, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7027, Parent: 1)

rtkit-daemon (PID: 7027, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7033, Parent: 1)

polkitd (PID: 7033, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7048, Parent: 1)

generate-config (PID: 7048, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7050, Parent: 7048)

pkill (PID: 7050, Parent: 7048, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7052, Parent: 1)

journalctl (PID: 7052, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7056, Parent: 1)

gdm-wait-for-drm (PID: 7056, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7061, Parent: 1)

gdm3 (PID: 7061, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7064, Parent: 7061)

plymouth (PID: 7064, Parent: 7061, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7074, Parent: 7061)

gdm-session-worker (PID: 7074, Parent: 7061, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7082, Parent: 7074)

gdm-wayland-session (PID: 7082, Parent: 7074, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7084, Parent: 7082)

dbus-daemon (PID: 7084, Parent: 7082, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7088, Parent: 7084)

dbus-daemon New Fork (PID: 7089, Parent: 7088)

false (PID: 7089, Parent: 7088, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7090, Parent: 7082)

dbus-run-session (PID: 7090, Parent: 7082, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7091, Parent: 7090)

dbus-daemon (PID: 7091, Parent: 7090, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7093, Parent: 7061)

Default (PID: 7093, Parent: 7061, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7094, Parent: 7061)

Default (PID: 7094, Parent: 7061, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7065, Parent: 1)

accounts-daemon (PID: 7065, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7069, Parent: 7065)

language-validate (PID: 7069, Parent: 7065, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7070, Parent: 7069)

language-options (PID: 7070, Parent: 7069, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7071, Parent: 7070)

sh (PID: 7071, Parent: 7070, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7072, Parent: 7071)

locale (PID: 7072, Parent: 7071, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7073, Parent: 7071)

grep (PID: 7073, Parent: 7071, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7080, Parent: 1)

systemd (PID: 7080, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7085, Parent: 7080)

systemd New Fork (PID: 7086, Parent: 7085)

30-systemd-environment-d-generator (PID: 7086, Parent: 7085, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7097, Parent: 7080)

systemctl (PID: 7097, Parent: 7080, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7098, Parent: 7080)

pulseaudio (PID: 7098, Parent: 7080, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7103, Parent: 7080)

dbus-daemon (PID: 7103, Parent: 7080, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wrjkngh4.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wrjkngh4.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1af64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6226.1.00007ff3c4400000.00007ff3c441e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6226.1.00007ff3c4400000.00007ff3c441e000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1af64:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af78:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1af8c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afa0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1afdc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1aff0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b004:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b018:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b02c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b040:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b054:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b068:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b07c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b090:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1b0f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wrjkngh4.elf PID: 6226	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wrjkngh4.elf PID: 6226	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x3fb1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fc5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fd9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x3fed:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4001:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4015:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4029:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x403d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4051:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4065:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4079:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x408d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40a1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40b5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40c9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40dd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x40f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4105:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4119:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x412d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x4141:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6496)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6632)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6726)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6802)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7005)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6466)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6610)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6798)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6896)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6921)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6954)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7061)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7084)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7080)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.45.dr, syslog.175.dr, syslog.125.dr, syslog.187.dr, syslog.284.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53850
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 53850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wrjkngh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6226.1.00007ff3c4400000.00007ff3c441e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wrjkngh4.elf PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4470, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4473, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4480, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4503, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6048, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6177, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6206, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6246, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6386, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6387, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6388, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6390, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6396, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6491, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6496, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6574, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6610, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6631, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6632, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6633, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6638, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6721, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6481, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6798, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6799, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6878, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6880, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6896, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6943, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6944, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6949, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4470, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4473, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4480, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 4503, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6048, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6177, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6196, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6206, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6246, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6247, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6248, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6249, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6250, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6251, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6252, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6253, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6254, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6255, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6386, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6387, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6388, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6390, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6396, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6491, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6496, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6574, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6610, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6631, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6632, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6633, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6638, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6721, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6725, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6726, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6480, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6481, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6482, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6492, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6493, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6735, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6798, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6799, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6802, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6878, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6880, result: no such process	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6896, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6943, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6944, result: successful	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	SIGKILL sent: pid: 6949, result: successful	Jump to behavior

Source: wrjkngh4.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6226.1.00007ff3c4400000.00007ff3c441e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wrjkngh4.elf PID: 6226, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/145@199/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6491)	File: /proc/6491/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6584)	File: /proc/6584/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6638)	File: /proc/6638/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6735)	File: /proc/6735/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6921)	File: /proc/6921/mounts
Source: /usr/bin/dbus-daemon (PID: 6926)	File: /proc/6926/mounts
Source: /usr/bin/dbus-daemon (PID: 6963)	File: /proc/6963/mounts
Source: /usr/bin/dbus-daemon (PID: 7018)	File: /proc/7018/mounts
Source: /usr/bin/dbus-daemon (PID: 7084)	File: /proc/7084/mounts
Source: /usr/bin/dbus-daemon (PID: 7091)	File: /proc/7091/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6232)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6232)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6237)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:76124w6wpC8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:76125ettWm8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:76204CM2gI8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:75666mZCyC9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:75668OiOq85	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:76601xYJEO9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:76602G0L2D6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:76713gcavY6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:77872oEJZN9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:78049w2bCk6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:78126AWWh37	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:78208n6nuq6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:78381aGWvX8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:78391MePYD6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:77330GvAVo6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:77332AGNeg8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:773944VCp36	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:77497KkBKg6	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:77512NGdt86	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:77623ciQH36	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:77724cZXdC8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:78831VXZSx9	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	File: /run/systemd/journal/streams/.#9:78875LjOSA8	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6507)	File: /run/systemd/seats/.#seat0VCXLMd	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6569)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6614)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6647)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6647)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6647)	File: /run/systemd/seats/.#seat0bAnyKN	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6739)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6739)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6739)	File: /run/systemd/seats/.#seat0AR8fcM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:794169YlPRd
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:79432ThOOFc
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:79439bHH83c
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:79450jxEKxe
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:79451fLJYjf
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:794522iemEf
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:79453QgFgkg
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:79454UtJNFf
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:80693smvhqc
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:807226TL6Kf
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:80817C3Ddxd
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:80926cjJZHd
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:80971XFOQQg
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:80973WFOaPd
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:81016GCOYif
Source: /lib/systemd/systemd-journald (PID: 6798)	File: /run/systemd/journal/streams/.#9:81018V5AGFf
Source: /lib/systemd/systemd-logind (PID: 6805)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6805)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6805)	File: /run/systemd/seats/.#seat0Kt5wxK
Source: /lib/systemd/systemd-logind (PID: 6805)	File: /run/systemd/users/.#1278HnsZJ
Source: /lib/systemd/systemd-logind (PID: 6805)	File: /run/systemd/users/.#127rStqkK
Source: /lib/systemd/systemd-logind (PID: 6805)	File: /run/systemd/seats/.#seat0kYNWlM
Source: /lib/systemd/systemd-logind (PID: 6805)	File: /run/systemd/users/.#1276n3DPL
Source: /lib/systemd/systemd-logind (PID: 6805)	File: /run/systemd/users/.#127oeoaaJ
Source: /lib/systemd/systemd-logind (PID: 6805)	File: /run/systemd/users/.#127B7GpKJ
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6919)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6900)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6900)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6911)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6948)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6948)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/seats/.#seat0J28FBB
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/users/.#127i5iajy
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/users/.#1270aDM6y
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/seats/.#seat0dvw81x
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/users/.#127dry4fz
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/users/.#127dFStGz
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/users/.#1278lyM5B
Source: /lib/systemd/systemd-logind (PID: 6948)	File: /run/systemd/users/.#127X3ooqB
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473547sgu7OZ
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473557D33Vj3
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473558Vgoct1
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:4735594xciW1
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473569xmMZq3
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473576JOdIB0
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473577DawrM2
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473586iiuXBZ
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473589IXBgM2
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473599U5uJH2
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473689jTBkq3
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:4736900lL2m2
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473691aLzX13
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:473693VwETO3
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:2618138f9hkF2
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:2470784CyCUE2
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:2470847vXrbm1
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:2470849xYopv3
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:3021972Zxxn72
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:3022586vkgGq3
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:3022588WoQeZZ
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:3189942AO8qE0
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:3189989tQGXD2
Source: /lib/systemd/systemd-journald (PID: 6954)	File: /run/systemd/journal/streams/.#9:3190109ygNfp1
Source: /usr/lib/policykit-1/polkitd (PID: 7033)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7082)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7065)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7065)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7080)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7086)	Directory: <invalid fd (4)>/.config

Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6230)	File opened: /proc/117/cmdline	Jump to behavior

Source: /tmp/wrjkngh4.elf (PID: 6390)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/wrjkngh4.elf (PID: 6878)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6578)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6580)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6585)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6590)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6593)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6595)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6598)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6600)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6620)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6640)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6642)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6704)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6707)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6709)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6711)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6715)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6717)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6863)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6868)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6870)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6872)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6874)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6876)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6881)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6883)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6906)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7020)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7022)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7024)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7028)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7035)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7040)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7044)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7046)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7071)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6579)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6581)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6586)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6591)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6594)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6599)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6601)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6622)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6641)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6643)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6705)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6708)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6710)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6712)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6716)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6718)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6867)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6869)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6873)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6875)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6877)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6882)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6884)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6908)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7021)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7023)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7025)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7030)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7038)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7041)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7045)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7047)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7073)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6603)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6720)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6888)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7050)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6396)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6880)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /usr/bin/dash (PID: 6212)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IYrpCRxer1 /tmp/tmp.dBC8wYrP8L /tmp/tmp.bpwRrm2oKR			Jump to behavior
Source: /usr/bin/dash (PID: 6213)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.IYrpCRxer1 /tmp/tmp.dBC8wYrP8L /tmp/tmp.bpwRrm2oKR			Jump to behavior

Source: /lib/systemd/systemd (PID: 7097)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6396)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6880)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6798)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6954)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6574)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6633)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6799)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6945)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6610)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6610)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6614)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6614)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6896)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6896)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6900)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6900)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7061)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7061)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7065)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7065)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6496)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6496)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6577)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6632)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6632)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6639)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6726)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6802)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6802)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6862)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7005)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7005)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7013)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wrjkngh4.elf (PID: 6228)

File: /tmp/wrjkngh4.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6577)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6639)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6862)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7013)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6396)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6880)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6495)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6603)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6720)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6888)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7019)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7050)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7098)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/wrjkngh4.elf (PID: 6226)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6237)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6466)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6495)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6496)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6574)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6577)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6625)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6632)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6633)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6639)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6726)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6798)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6799)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6802)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6862)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6915)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6945)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6954)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7005)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7013)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7019)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7074)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7098)	Queries kernel information via 'uname':

Source: kern.log.284.dr	Binary or memory string: Dec 19 12:45:44 galassia kernel: [ 589.461205] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: wrjkngh4.elf, 6226.1.00007ffc81e28000.00007ffc81e49000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: wrjkngh4.elf, 6226.1.00007ffc81e28000.00007ffc81e49000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-sh4
Source: wrjkngh4.elf, 6226.1.00007ffc81e28000.00007ffc81e49000.rw-.sdmp	Binary or memory string: z+x86_64/usr/bin/qemu-sh4/tmp/wrjkngh4.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wrjkngh4.elf
Source: kern.log.284.dr	Binary or memory string: Dec 19 12:45:44 galassia kernel: [ 589.461170] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: wrjkngh4.elf, 6226.1.000055941cb02000.000055941cb65000.rw-.sdmp	Binary or memory string: U5!/etc/qemu-binfmt/sh4
Source: wrjkngh4.elf, 6226.1.000055941cb02000.000055941cb65000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/sh4
Source: wrjkngh4.elf, 6226.1.00007ffc81e28000.00007ffc81e49000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.k24O0Y
Source: wrjkngh4.elf, 6226.1.00007ffc81e28000.00007ffc81e49000.rw-.sdmp	Binary or memory string: U/tmp/qemu-open.k24O0Y\T

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6614)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6900)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7065)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wrjkngh4.elf, type: SAMPLE
Source: Yara match	File source: 6226.1.00007ff3c4400000.00007ff3c441e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wrjkngh4.elf PID: 6226, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wrjkngh4.elf, type: SAMPLE
Source: Yara match	File source: 6226.1.00007ff3c4400000.00007ff3c441e000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wrjkngh4.elf PID: 6226, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wrjkngh4.elf	36%	ReversingLabs	Linux.Trojan.Mirai
wrjkngh4.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
raw.cardiacpure.ru	178.215.238.25	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.45.dr, syslog.175.dr, syslog.125.dr, syslog.187.dr, syslog.284.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.25	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
178.215.238.25	Aqua.i686.elf	Get hash	malicious	Mirai	Browse
178.215.238.25	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
	vsbeps.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	woega6.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Mirai	Browse
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse
	abc123.elf	Get hash	malicious	Unknown	Browse
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
raw.cardiacpure.ru	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	qkehusl.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	vsbeps.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wriww68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	jwwofba5.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vsbeps.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vqsjh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	Aqua.i686.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Employee Benefits & Bonus Docs 2024.vbs	Get hash	malicious	AsyncRAT, VenomRAT	Browse	45.88.88.7
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	94.154.174.120
	CPNSQusnwC.exe	Get hash	malicious	DCRat	Browse	45.88.91.89
	b3astmode.sh4.elf	Get hash	malicious	Mirai	Browse	147.3.223.242
	jade.m68k.elf	Get hash	malicious	Mirai	Browse	94.154.174.147
	jade.mips.elf	Get hash	malicious	Mirai	Browse	64.8.51.71
	jade.spc.elf	Get hash	malicious	Mirai	Browse	94.154.174.107
	file.exe	Get hash	malicious	Unknown	Browse	94.154.172.218
INIT7CH	woega6.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	abc123.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
CANONICAL-ASGB	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	abc123.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6924/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/7089/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mT2:mC
MD5:	BB36859EF40AD2F4F9B8CE45D3C16A51
SHA1:	1DA253F50BCBF42E00FDC23DB74CA7C0BDD80B25
SHA-256:	5489E7EB4E62B0ECF42E30A9DC97489B5C8F51255442A211A6F4717727476C3A
SHA-512:	BC1ABCABA4788F23D5E0E1EC555B76327B5DF7F270098FFC6FBFBCC3CFFB3BD57C05A4C5263621F2B5310CCDD9AAE3ACA3DC8FF429E39A9EEBC8C4BB72E798E9
Malicious:	false
Preview:	7061.

/run/systemd/journal/streams/.#9:2470784CyCUE2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.430023463818946
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mv0Pbhzq8jLTTIWTIL:qgFq6g10+f+MMl+sEWEL
MD5:	0FF14399EE3021BAF743554689CDA90D
SHA1:	A0D074A94184A255AFDF8F59474A6F473EBB0BCA
SHA-256:	F4EEAC847E999F091F2FEC0B84053E43259A6BA5FD2E32E29A08EE652A3AEEE9
SHA-512:	F57F36E9E7284566D01873D920D016AE5CFC3D89F0E2BF31AE179C285B166897D2D0E0E18D030D449DABEAEC1FAC59379C1E0A4EF8694FC560460B6638365704
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3e3aba329e9452085954d48529e26bf.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:2470847vXrbm1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.437313083140991
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm8WHbduz5xvsMqjk:SbFuFyLVK6g7/+BG+f+M8WQNx0ZjNq
MD5:	01AEFE04FB1A2E8ADCB554FDE9DB1C5C
SHA1:	B06AD6C8D46857C6EDC8B48B5536942CDC80AB8E
SHA-256:	BCF7CE21AD3F45CFC80E36DE7FC0E3951A5E5EB7ADC06417B4DD041609F57812
SHA-512:	1EFCC1C13E41D54AFEF1B6C0F4D3BD882191EC1635B781B14B61358CB54FEBD2FFD138170528A7554BA4788BCE5D6507A8E80285458119060CFC68EC121B6133
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=65fbc33b49f34106b2fb2d4770a06408.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:2470849xYopv3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.424854316254473
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrwR6VollpVHvjsz:SbFuFyLVI6g7/+BG+f+MA6ulljNq
MD5:	53AB88C1A4DAFD8CDAAEA9BED2C2FE5F
SHA1:	52955EE7A65A4456206AF395E3B6D1D49CA0DE2B
SHA-256:	8E3F7149C638572FAEA3EDCE3003EB700FB492E90BC76CD7411E7DE985DA05DC
SHA-512:	65577E85EC53A6A9378379A286077EC7C4489F2612F432110887371AF5B019A4AF7F3E304535508B87D1998F9A970D58A2EFD1B5D0BC732DDE1C92C6260FB165
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aacc1a4a6bdf49fa894355ef812e57d9.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:2618138f9hkF2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.342431087331409
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmvmqkVVFB/Rqjs2BZZGu:SbFuFyLVIg1BAf+M+qiqjNTZD
MD5:	5F5EE77A3822880CA42E4E6FE72C1007
SHA1:	3BC3FEF3E8667900E04C7AFC502210E4697B4066
SHA-256:	A405C5B94B8D3A5E494769F602F0018C4D4846680676D2A916BE8DE91765E0ED
SHA-512:	8E856D4693F3CAE954DDA43569ADCE9EF1CA0361CABD5CCAE9E761658C783116B3138F5E40E88D4B167BC7D37468A84CA7FC6305F0D460C2749F685421EEDBE0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e920eca94f4f4000b9920afe604ea51f.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:3021972Zxxn72

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.440367496128024
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mq45iy0G6XjZcHBrt:qgFq6g10+f+MB6NmBB
MD5:	80521C575B11310A0847595CA28F63C5
SHA1:	D1E1BB35F18C18177918B7D0C25F149F1099C239
SHA-256:	4A57B080743F7E0D2DDDC70499A24034F3C8C48614AE73379112AE47B445B59E
SHA-512:	ED575E9A53098EC8C9D0F71235C9D21B9EA8282BD4E2840B4D521A514FD9351559BBBB76A2E12917BAD7B9E767C3DD2F20FB36E30870022C70387880E9BE1A8A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=181bfa067a764f688e4023c64145d974.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:3022586vkgGq3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.473901035244733
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M8BgqEXF2jFQMzKaBu:qgFqo6g7/+0+f+M8BeX2Tmh
MD5:	95ABFF8B5F5F1F6B8CD62AF2211B7010
SHA1:	131EACFAA10468C5BC68EF0CB9B26B24E3F5D003
SHA-256:	ED8E64CFCEAFB4B68AED6E9439FB4E0FB3A1743E3EEB2A8F8EE55C52239C1AF2
SHA-512:	FE7EE75770F3124D868250B2647CFF7019CAFBDDDAD38A285DD3673E517BB17F2D1FB19F35FA895E8C3619599B41E43914B30F8F15BA97CEC068B1760F3851DB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6db62156664945e194dfa9db45ff4a6f.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:3022588WoQeZZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5327928063840615
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MyAEQJ9ZjFQMzKaBu:qgFqdg7/+0+f+MUQTvTmh
MD5:	8A7AEA79F116C15575D3445F571955D1
SHA1:	2591FFA32D6C66AF966259C943D66CAB0CA04D12
SHA-256:	745C5C9DF1DD69BA3135FD27C25F3E3539A7DF5BF223F72B38DF98A585B45EFC
SHA-512:	55825FB6B974560A1CD11BEDB494DF761E37056CB9145E51439752F14EA3F7BC547DC41D85229147C5A0CCF9F060ADBB00868B4F803A9515EB723A41B2B13B99
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=80f635e770844385b2dba501f900c651.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:3189942AO8qE0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.390374471279107
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8wHrdRXzEocQm0jsb:SbFuFyLVIg1BG+f+M8w/XzEohjjZcHjv
MD5:	0F1462ABF49E188E577659A4C049C393
SHA1:	D886E590396720F1DCD32939B39A0CC639BE7750
SHA-256:	D8E739F6CFAD3E2AD199D98AE2995A70F89415498F652E87317FC68486763239
SHA-512:	E17AA45130C15B21D95C9E9FEF594B943A676DFD87D511DF4D934DD2EA0E30239A125F17D4E7A0C0FF1B045B84CD4F57A3D5AEEFD197C8C37C9E86630A85C93C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=69dbe43e869842c2b6ca91f378e3654e.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:3189989tQGXD2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.36521876707543
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5WcCG+l0U4ANlsjsO:SbFuFyLVIg1BG+f+MIFJP0jtWL0
MD5:	1296361D203C950C6A9AFA180A8BC434
SHA1:	DF4BAD0F954DE9FBA830211223728C85D9DD0758
SHA-256:	BDC87AB081436D87C5DE902282018C9A1FEE1ADDFC740E6BE4814ACF17871C87
SHA-512:	3C5F18FE9A5FFF17EEF66FB3AA8A800C22470A3A2FCF948F4D5EC5446B5DD8D00B4C70EF6C18AC01D7D934F2D4891963B9CA660BFEAEB4D43CAC9CF7A1753217
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=32c315ace1fe450097c0f86eb21a4953.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:3190109ygNfp1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.404662792201114
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+ggVEy2WDUVvsjs16:SbFuFyLVIg1BG+f+M+OaUmjoa
MD5:	2A418B5C7059BD10D8AA5E4AEB289030
SHA1:	393A450B37EA199C40171AE1740786B2D256103D
SHA-256:	363D4F4A9D6800356C6515269C429729F3BD8203C87E69F86AE504EDCA23FF39
SHA-512:	466311248B88B75393C2D0D8C9CCC18A3B953A7961FEB40EC681D671B0D380AEC35F446EA91C8C572E63B93CD81BC95A78E18C496DD66F9417CE6DE668B17F0B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=49c594378cf64c3caaa3f6f7868b32bc.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:473547sgu7OZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.508756975959028
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+s8ShD2F53D0vsjsv:SbFuFyLVIg1BG+f+M+zShEY0ji4s
MD5:	39960F26EEFC2EF8B71768669083E3A4
SHA1:	A5B972785A93128ABE02962891363391466484EF
SHA-256:	3E9910719AD273448E84A047C75A105A5609C8BA2379F4BD4F09AE3C040E2061
SHA-512:	223117064B07FC3695554EEDB6BAE3DF3BF5E407D719A2F254031EF209B38C89C7E744A41F191252CA30410FAC615837F14656C373C095DC803275C09D50A9AC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4e3e2e40795f43f2b0e5295f919cf742.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:473557D33Vj3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.43977352001008
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7gAWlRDU32URIW2vE:SbFuFyLVIg1BG+f+MszlWm6vjosQu
MD5:	3E09AF8EDD93BF5FF420E467033ABEBC
SHA1:	C3EFE97DE8C8149A9543AF6E826ADE4CD6AF0B06
SHA-256:	EC3166E366C3056CF09265223C41256C7723F5E2CBAD7FF9825647B7194A0F80
SHA-512:	688583A7462F5C4DA27AADB23A76026974073D16074E7B12BE299698B350B6B0DB8348BD56506D8107202C3D17BAB9B1D7F1C6B1453619A458F302130C575C88
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=14c9abb4a3734f8685dd9b41864f7345.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:473558Vgoct1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.465118052284811
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6upyjarqjZcHcljX+:qgFq6g10+f+MIjgkmAu
MD5:	641E52C106C5D447CEEE36317317283D
SHA1:	A2610DA8AD20B3DD0065768F465C3B81B50CD2CC
SHA-256:	2CE6379F71738052117EB631833E4A79C30697DAD2A5A4B650C2DF94134B6AEE
SHA-512:	255D1526FDBE8AC42164D7B9DC9EF53D48498E233227374CAB70DBE014EFB2D761E113D1E81321E82F18EFC348FEE12E2C1A238EDDF56E45B5299F9CDB163E26
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03a660d89f33476fbdbf63720ff976d7.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:4735594xciW1

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.386903431735833
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyeRw8/SjVEJ8jdCLKzK:qgFq6g10+f+M3RwvViuCLAK
MD5:	2019745D4C005AC2F094E43BCCA8E33B
SHA1:	C4CB51FEB87E32349EA484E3FA381777E7EBB73E
SHA-256:	E1A96FDE7FD598AC4011FDE2F87F769EAD7A724751DBF4CAE955A03CB9561631
SHA-512:	E2CC4C9A693BC94F46DA98258DF58096963593C9690D4246B107B9F88465F78ACBF05EED8D3148B9A15183DEC1E3B8137FEF81861FF451D2D71EEB98BE15C833
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=86749f7b0cd74e8b9a37f88ac345b0a4.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:473569xmMZq3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4297980051971795
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8FH1DGEwDQXuAEsjx:SbFuFyLVIg1BG+f+M891DczmjosQu
MD5:	93CD883709E3080748128ABE0D73E8E3
SHA1:	32C674CBD49144CFEE915D73D113C58F9DF0462A
SHA-256:	E91989C3DE6141B4F80DFFC47DB987B2FA1D1C4E48EC76FF6FA311F5D9B43052
SHA-512:	8B0F10F1C0052E3DE4279C806486C3385DB2E22D8FB3A0775BBCBB8F560A8C5C84375B5B5C96075A91A47EFD04786BC5DED445A5712E6EF657A7696B17155B5D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=619b46fca32a48cf8e9d2652a35fedab.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:473576JOdIB0

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.386825655244598
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MUtfn8+RtJsZjdCLKzK:qgFq6g10+f+MmPs3CLAK
MD5:	8D2F35177401E9093DA048A8793404F0
SHA1:	907E46C77D8A05D0A301CF60A913EEE9171EB336
SHA-256:	0C18F24390DF9D311B9DFA3E13D341CB217408EAA098B0D631FAE256E31B64D4
SHA-512:	DEF7A938E87DE27697E6EDF3BC6AE1A3DE296144E60306B74FCCE89298470002359CAFA1C3BB6162CA7B2485BF5F77CB4EA93531A867ED4C27CF2991B090213F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9c3f7991c9f747b4b51c5014a3575674.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:473577DawrM2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.36593714977263
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8GWhWURXIcTySRxmg:SbFuFyLVIg1BG+f+M8G8RZxmf5qjoa
MD5:	4479DE2AD62A2861ECBF156A52FD0467
SHA1:	2EA8EC9F6FDD6BCB533E87CC6EDD777A913D5C95
SHA-256:	4310217E3262A0751462AE5A81E5AAAFAA0213A462DCE2D7E2AA798A2D284726
SHA-512:	128154E99CFB20749D93635A58168525E24D9901724FA1B876B207FB83452D366F04CDDBBAB6BE6F98E69BC9032CD52AE28CAA3453FCE92F0E80570EE693F6F6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=629b3ea3143c4214984d32d74e198b1c.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:473586iiuXBZ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.37153308094614
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmslWHUQR1mQSgEyGgE:SbFuFyLVIg1BG+f+Ms09RIHBVuqjtWL0
MD5:	67948CB6F960DD553EEE28A87A0B6070
SHA1:	05CDA89E08352ABBBD786EE56AA20B5FE22CCCA4
SHA-256:	C56E523D3D2BBA4AAF7F7D464DBBC7D68CEB20C3F7EAB059C05755232AAB52BD
SHA-512:	B163CF697C268F468A44A6B6B12608943CFD1BF92F773EEEB91F06A57B6CDC27DB4844187A8267353D554E4ACFF1FA94EE0C03E21349FFA8B84BA6F10B2C25CE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f2df812219ff443e8ca15798dab5f0c3.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:473589IXBgM2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.412551374730623
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp1GRTif2cdVXQDEvJ:SbFuFyLVIg1BG+f+MGRaVXo1jNE
MD5:	C2284477998CBC432F4156FB51379FAF
SHA1:	353E492C591066F4B7BCA3B0537F6BA8B8FCFB41
SHA-256:	865BAA219B1CE808BAB7A20D48E062C41F12925E766E656F6C9DFF06F857A579
SHA-512:	7518E2F73BA5CBC334CE428D1277377DA15C7B65E6D0ACF7EC56C237254BCD47E2D1A522FF494AF4FCF263DCD2D8F76DAE38EA5080749345EE78DEC3D524A62B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ca9c4ff4954a4600998025965ac983c6.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:473599U5uJH2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3800974920296065
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GaBETyEkcdd72ls4:SbFuFyLVIg1BG+f+M4eXVXZjbVC
MD5:	3CF824B4F881E7F6A940433146994A9A
SHA1:	2EFE82DBCF42988DDF220B7BFE5BB46E9E177E3F
SHA-256:	4345256519F60F5BC621337E6236D96177E30E8B37C64FEF827DC498FEA5FD75
SHA-512:	6EE239BE97D5DA386D1FE4920492A50AC4E7823E2971C82B3B460CE8AA13744143550026239B5ABD3932A8C0DA3C7B1F1B4F308B7C1B91B89C632B48959E3D37
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c96e70dad3f4a41ab73407987a6703a.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:473689jTBkq3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.416276121682449
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MySzOoD1WGnbZjLkGq:qgFq6g10+f+M/LbuT
MD5:	1A4F550BD9B4E26E5A0B70179188A689
SHA1:	194718FACE7C0A00B44A5919F3565F0F99D73C6A
SHA-256:	EF387EA368E2DED2169FD1DB7CEE60171FF944ED8B01139836AE14AEFF2B91C1
SHA-512:	EA3F260D53D7BBD96EC297BF66BEF087882933679BD71BB10CEF8592CB2255ADBC98078AF2313EB63257D51A1E6445E091061919CDE9B47BD0E8183EC0A1DD47
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=885b6ef6bf2941579e52766cfe6ac1e0.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:4736900lL2m2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.425110220044725
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MuioqAVV/GJqjNALyAZD:qgFq6g1af+MNoqo9GmIZD
MD5:	C5C5DE11C2377A6138380757F8F96156
SHA1:	D83A426291D00C364728D91B463463A245DDF79A
SHA-256:	E2F73FFE7A89F4BB81C97C60A96127FBF7E1419D9D890373B4BBE364205E5CCC
SHA-512:	7EFE5A6176503F04FCA26175EB6613623A45667357F5DBB29E3F7B91C1DAD3FADF889A384884274656D7E8CC7946F60A317E555A92BF7A3703402C6C396D04F4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d42fbeaec0e442528bd9a8f8c29cb741.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:473691aLzX13

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.552504424914881
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr7zsbGdHuAWLGjs77:SbFuFyLVIg1BG+f+MCDLGji4s
MD5:	BB5E0C445B58F900BEF81650B0E137EB
SHA1:	CD7E1B3497A38D630AB24CAE2F4C789B1F788008
SHA-256:	63D4330D5FB038F6221923BCD5C6423CE9A12845D10D16E5B7738AC5797D0884
SHA-512:	C4C188478170697F0C9C23DD775F40004B663011F720CA5DD19AA49761F9436B8F23F42F982ADC23B8FC2E1B8265983D3B3143909D44A8D9C67C10DE41A3A799
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a536fc27fb214d819c81693fbe3f2de7.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:473693VwETO3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.485099264539934
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyW0qqTGdPcbHTjs2BbM:SbFuFyLVIg1BAf+MyABdkbzjNdQIeXD
MD5:	D0798E66AAA067BAF23DE38523015A77
SHA1:	547EC30D4EE0A4BFA216022205CBA5A2E89B89E9
SHA-256:	7A74ADD3E4F6AD10F7E6CD2E03C2A0CA81951339DA2705AB9A24B52E2D52749C
SHA-512:	4F2AF115B2A6348EBA221AC29939D74DC4B64EE10D04EE8B2B3D529F3B7D0159320E4749FF932114888A173C5D7C69E244FF831134631B4E5C26D30870C9BCA2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=81c0654f4f7e46bc8656890c9f3eb56d.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:75666mZCyC9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.367282715022142
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz+ESOV0UBVtRqjsmM:SbFuFyLVIg1BG+f+MHLJjejdCLKzK
MD5:	D12488C616344E721885AB9EDF7A0108
SHA1:	5C06E5F984F8D958DD5941AA1D24CAAC3B3C6120
SHA-256:	3AB5B6D9322ABB76BEB7F58B15F96AF94D90984A5F4E8915CD70C0C333AB97B8
SHA-512:	BF1D0500F0496F08535C5659C27CA6B9EA4EEA79A5F6B8066042CDA7B444A6B4B346ED8B46FEBF414813E1B7F868DE6D97139C9306DB4A8A13097CC7F2770986
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90508eb74d894ea58ea67b1f95c08f08.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75668OiOq85

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.355025617926138
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6pFG4QJUGvGwsjshQ:SbFuFyLVIg1BG+f+M6rG45GvGZjtWL0
MD5:	16B995DA43F37911CCF42EDFE5F15F36
SHA1:	9BE43DCAC4E2D055E819EB19EB0B96F03A2F5A13
SHA-256:	937B3C0E41529D5BE064AACBE321D0F06998C10A47020639160F9A8699D42DC0
SHA-512:	5266C6F192117081890CE5CDE6FB69BB7DF04BCD130DA870ABBBCDB5CCB3A3CACCF6C0F9E6CC5EC72918728451BDB24F36A067CBBDC3CBD1F01E0FAB236F69AD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0056fc64bc1842e183d36cd21d4c648b.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76124w6wpC8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4971422205070875
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvGWVI5TrUKWj2js77:SbFuFyLVIg1BG+f+MuaI5TrUKTji4s
MD5:	3A49037BD87F4A954410A52C82E360FE
SHA1:	167DA9C4861E2C8419A9003AE7521BE490F6E75D
SHA-256:	8FC7EC1659167D65E8F7E0FD67EFED7AE3482783E6906498BBA8B9BF5D690151
SHA-512:	9B0E181ADE6BF7259F0DAF67791D26C47BBF4BB7F51001F5085EB090643B726702945546B190A4E50557EF279F4CC976E5DCBC2FC700BF6361F2CDE7D284DDCD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e5639e6c8acf481eb6bed4fa06f3c834.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76125ettWm8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.508225039350185
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5psPdqcdUVLvs2rq+:SbFuFyLVIg1BG+f+M/cdqtVQji4s
MD5:	339E12568AF10AE4267098D8C7652DD4
SHA1:	1CCFF3E736115C05B680E9233A8696F1465DAA9E
SHA-256:	B22B72F7711530FD3A4CB210C8F30C719483EE541627024D55ADE38E61712CD5
SHA-512:	09B9A67C287F9C1C97072905334C8C13DDD54A1507756EB6BA68984C4AF217FB4C85D782188C72C998738D5BD7CD9E10B428E5DAE3144DE62C6F34CE7F5E0A36
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=39d30c73138b4f4099098e5f46e10a9d.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76204CM2gI8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3988827304124465
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyNYkBPS/E+NOnBvAJ:SbFuFyLVIg1BG+f+MyTPczOnBYTjosQu
MD5:	CEA89613FCFA0E81F482FB1E9DFA12C5
SHA1:	F105F9665DB4B05F15FD3677D357F2076538DEFD
SHA-256:	504C39AEB33AC0DDB6AC9EEB87D865D0D785F82843FB2FA1BBBCC5CB9902CED7
SHA-512:	7B779597D42A415E92225CED5B68BD6FDA9D7A6B1363C90F692C45A8968E3FB1504960A3FCBCB5872CC49DB69E699BC2471B4A1B678089E70122150E7AECA73D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8fccfabad4c94274a9acb8f72a6d9bbd.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76601xYJEO9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.435521414168171
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8NWS1PGF0JDGnQEv5:SbFuFyLVIg1BG+f+M8bHSQ1jNE
MD5:	5B2BE3593C212B4D29EF6B5BA4BD0827
SHA1:	298ADCC84DB47A6B74E52B6B4798435A82AF6464
SHA-256:	F69B4E8E53AAEA609156100D35862A06DCB87ECB2694091951316A314E5112B2
SHA-512:	C64A97B5AFD5AA8004C38E91874715B1CC2AF47C1EF8BF19213CC1ABA5C5EBB6065A6DDD3D5C0BA93D4082AD28DDC3437DF4707A9E586EE0823B5B0803450A1E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=611385dfac2c4cfaa7b16c7fc432145a.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76602G0L2D6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4482980359681275
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyOU/BnTjZcHcljX+:qgFq6g10+f+MrU/HmAu
MD5:	F370E1B41FC14FBD730EAE3571AC1088
SHA1:	818E73EB35D91A5CAA9CFACD1388F0FA6020A56C
SHA-256:	914B1761F32B445B946C5FD8EA518D5A013690E6D1EE9C2208700BCBC2C6F1ED
SHA-512:	5137170BC122EB373CC8C18568F0040C498A5571E7A34002AA21D731EE1F9216C082B2A703B44D0C0FC53E1FF1543EFAA5E18481AFE36CC51B4C9B4E9E570E95
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8abc2379b43047d1a9efcd7a3e7b9dcd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76713gcavY6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.443811609047267
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/h8QyO4vAuqjshKJg:SbFuFyLVIg1BG+f+MCNOZTjbVC
MD5:	C96C9097629B227AEBFC8B84CAC4986D
SHA1:	7C937C5E6CFA70ED46B5D188E07BB5D1EA0C2E91
SHA-256:	0B78AF14BC6FD924CBC2324392B82ECCC09D15769D2E56B4C7E29609425C833B
SHA-512:	E9F5E2EA0B789B53CF01FE7A732352527D1AA5B02072E9E87FE18EB9BA7824F0FFE38791AD2A854EFEC3A7392A25726B2F1D0CFE257C5048AE2DE0166AC3DD32
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=577b9ff6c6ea479c821d6687428fddf4.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77330GvAVo6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.371094573483332
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrwdxVMRmxV27Zjk:SbFuFyLVK6g7/+BG+f+McFMwxkjNq
MD5:	8BABD320A847FF42B19122DC2594DDC8
SHA1:	6F9B98ADEE9B86D3404683B16D01BEDFB2832134
SHA-256:	5145FE508A6DF0ACC0A59036B1F9BD34C4AA8485DE64194A020BB45FDE82DDB4
SHA-512:	F4307CDF019CDE30F94119ADFD8FD6D51778C252B28E99F1DBC2A6B2CA18D93B5B86B6EBDCF2E9ED9225D878D3B1186E9D16DDD0259888F0E003BDB98F60BEA1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ab58e10668e244e8865a62175ab08c54.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:77332AGNeg8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.414634188845758
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmz0AVfmzENgKF2jk:SbFuFyLVI6g7/+BG+f+MdVbF2jNq
MD5:	20DF5049535D040DFBB8FEF115F712D0
SHA1:	E2F530C0EF82A5D8E4300E29EEB539E9CD2F57C0
SHA-256:	0807F4CB06F1091333D32E7F591BF940A8546453B4FA2AC43E164EE031B231BE
SHA-512:	DE1EFD5A84EF5A5969AF7C8D690A826BCF9C164D9D970D17520EF6E98C74A027705FE3D16E6D3DE23B6FE1E18C4DD83B804F2936C17C92CC1C0A078E4B96E453
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=93b7ae01cd144ffbbe3aa73126489f4e.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:773944VCp36

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.33862454202843
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7767RPAQVWbNlsjst:SbFuFyLVIg1BG+f+MqKAS2jdCLKzK
MD5:	31518C3103124036C56353616083DC92
SHA1:	72AD02BDB596E6109C172DAFD7B06285BAEFCC98
SHA-256:	8C4FECD0F190DDF5A8A0DCE818D9617C65E60FD49D97206A98FBB0EAC2EF2A84
SHA-512:	4BB0D30610510988908925F9009E2E7F5FFC5AD8007097D1F726B4860764C8952D49F484A6218A321E4321E1B0C9EC113862C01418711335622869EA6B3B0824
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1042e0331a86440b8de5087d486a13d3.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:77497KkBKg6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.347370650358315
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4nGuSjiXCNrxsjswK:SbFuFyLVIg1BG+f+M4nmiX3jLkGq
MD5:	CF764ABD8D476486778B54B776C1F393
SHA1:	81DC407BC6C8871320DC477FA9BFE6FC1DAF79D4
SHA-256:	7A066D4D09ADB401B80DE477A929D46BD8AC375CEDE308B45A7C0CBB9C7B35F9
SHA-512:	B3B8EB9E0055059635F8A387416566C93D9AE6CCBB0079ABBB13317987F0D49C78BB7818A769B1B05C665621C35AE7D8F7A122C0F817C7EFEA1034714E815383
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=237202cde0ca4f038fec316b3de34230.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77512NGdt86

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.426060595072418
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmux6tRGFrxsjs1Had9:SbFuFyLVIg1BG+f+MuxesrqjosQu
MD5:	AA67A1AF224A4CCFA0860B1AE72F6859
SHA1:	607200EBEC8EB55AA8B0298802DECD126E7717C0
SHA-256:	817E214A0C69AEAB3D56B106776065F79B9F4A59208A128C9D61C477A477B3C0
SHA-512:	C4A1B2F356C90272E256ED4695936B3C0B94D18DEC86FD177F52412BF10F973667771D1789CA1D215962C912023968CBAB1AF1655E686E498387C221AA8B6841
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d8065ebf0ce94c21ba523d8f99f5084a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:77623ciQH36

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.5062747973415975
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyVJbqk5qjZcHcljX+:qgFq6g10+f+MMbqk5kmAu
MD5:	F430829CBBD7AB40BFC066B042B81DF8
SHA1:	A0E19E69799522D0E3721D9119E3F8DDE36EA1C0
SHA-256:	7EF7ED2492B3B13AFB09F177110F6658AA53B8C5DB79B02E7823B1F0C1A2BF39
SHA-512:	284BFDF4DEBA50CCA66F94C1A779368E7C1E10B530B2CEAF9A90A59BE716A12101515EE4055FD27D4B22AEC09896AEBB2875A2DA0D07C1DDFD439DC154CB6683
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8af676d260fb4a17845622c3ae4f7e91.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:77724cZXdC8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.452497600637643
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MoGyWSldFnjNALyAZD:qgFq6g1af+MoGyWcFpIZD
MD5:	C3942920A3AF6B2FAD6CF671318D8356
SHA1:	A613D6EDD55499439B46134C13C159B2BA96CFD6
SHA-256:	2EBC188B881C7634EF57E33BD9A6068500974EA383104204C71F81EF9B31B57A
SHA-512:	3ADA752D0124958706C484C7FB826C322FCBB20D66EB40AE1BACDB603AFFFF7A4C4BAA097AEC53244B13B0B1F08206290223FCD0368AA7404EBD1D660276B9FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1d7cb769f77e4338bb8220075d9703cc.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:77872oEJZN9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.434980354812757
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/gX1BBSRHUc/Xesj+:SbFuFyLVIg1BG+f+MoFBkRHUuzjLkGq
MD5:	184403A090773A8AD78EEF986CD3E848
SHA1:	EA68BE75B13E20FF2863D5333F191EC02800B9D0
SHA-256:	1CD9E157288F22E8CA0D45059A211697B7FAAA49EA6CA0A9174974FB37A4A84D
SHA-512:	40831D93AEDE8FD6B6BBCB0F8D4D3DB2100A79982CC6434AA59A8759A7B7273489404210EC0D7037E445814BCB73C5FB49CE4DB3BFD4FAFC1C4AB19BDB4A528F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ccc80a951d74b3695400a422f6972b3.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:78049w2bCk6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.460561855464039
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MyZxMG2DRqjNALyAZD:qgFq6g1af+MOxERwIZD
MD5:	1CCF8A097B69DDF83A2214CEDF914BE3
SHA1:	8357E6505829D320FEADFEB98FF1B7B3D663F5EB
SHA-256:	B497A3527DC1BEEB5837DEF8BEC5E6FE99AB2A9DD144E06657F0509B81F89732
SHA-512:	B040B725E73B9D19829D1CFB1383851B8EF1141D5286D57BA1AE8B8CA615A42C2E003D559C01F3643704A3022D1F47CDCA0E34302277B8A81CC9E39E45B26744
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=13da7828f5ab42b98ce6117cdb4eb539.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78126AWWh37

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.481674157615843
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrRedHXlHE0Zjs2BbQIa:SbFuFyLVIg1BAf+MQtlbZjNdQIeXD
MD5:	5DBE3CF19C0B3A01276327FDBDBDE38B
SHA1:	3B4E584C6409AF9D51CFE12A350F4C3B35069E84
SHA-256:	A8025D9F723891CF025E290BA223E650DB56DB91C105E0CA876391FB0619B883
SHA-512:	C6B6303C720ECB7354F12469AF815FF9574A258CC0472E48C40E043DDAE786385282B850B3BBA2F0BE21B14FFFB24B8664390BF2A538406BDB69CF2E7C1142A9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3779c186ade442c8b2d657fe73a42d9.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78208n6nuq6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.455572222214742
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MgkfKOHJN2jdCt/rRMtq:qgFq6g10+f+MhjcCDL
MD5:	16DECBA63F6A971C06E764DBEBD8FB69
SHA1:	892FDA1AE808B62938013F0CF7A894D93C0CFF3F
SHA-256:	6DC34FE629E54576DE656E053CFF478E4823F6BC2B25C3EA490FE49F8BCBE908
SHA-512:	995CE728983752CB3D198B67A97D373284174DEF98FC7D1EE6929F75CCAE0D0BC5D5C82D88D43EB963D90B1CF4D55795852AB1CFBC3C4B22B66371460B57A37E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ebc0577864e446da5fdb70f2b0f7bf0.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78381aGWvX8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.432591783360838
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsqUHdDPxCfcHEIYglsH:SbFuFyLVIg1BAf+MsvdPx0ckJTjNTZD
MD5:	13BA8678285B9C49D1C13B209167C449
SHA1:	A8E20C52C98CEA8F87AFE1E261A2BA11789C10AA
SHA-256:	D067C28146BED4372610361D909B9D14129E22AEDDA5F6C9E8179649458217AF
SHA-512:	DAAA5BE9045D436B7C5EDB1303BFF49FBAA7351C2E356E1D70F84969707E0A80C79FC9CC777A4AA6564FBAD0C593214D90C2F9D859C503E2926DE1D937AFE64C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f05e451b8c1f48db94b7f82a65b18e93.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78391MePYD6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.417771679626085
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+R+aTuqjLTTIWTIL:qgFq6g10+f+MlaTXEWEL
MD5:	7AAF42DFA108C59BED5F6121469615D2
SHA1:	D62D8824ABA36BBFBCA488E8F11985A5FB9DAA00
SHA-256:	30AFF232730EE0EF5117F45A076DD08D52CA7E708AC19145F30460DCEE229A63
SHA-512:	F9733CE3AB4FDFAF1A72E0C4A8B10D494B3843C75CC4DA68AA7AAABF981C897B49131BFBC76D4CAE647F0DDF9B1A42FAC963A8B7635A47CD7728B8409F78FF81
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4e04690977714a20a45d2cc5b1b60997.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78831VXZSx9

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.469398847351469
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M9rD5xGBhBGH8jNdQIeXD:qgFq6g1af+MlEGe2D
MD5:	68602E42A77295CB04A49658BA62252B
SHA1:	ACCDC99AE84A8E6E116CA62B5B5938F5E84BC423
SHA-256:	0C65EAF0FCDECB0379074CA0C6DF1939A2722F96B116A95DFDE38DE27227E123
SHA-512:	2F562A9BA795D5482C7D28FD205C6D853FA059F1E4BC0F2B8C5E3DC5466883969CA48F3234326E5EEFD147CFB7F18074E289ED0CA2474FD5D0FFBF4CE9D65339
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=95d8e40bce7e4f7ab4564dbd9523d4ff.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78875LjOSA8

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.386345532792146
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmun8b21VTXTHyZjsmM:SbFuFyLVIg1BG+f+MuJl7KjdCLKzK
MD5:	7821C8A79D3E80F2EE2202ED5FE0ADB4
SHA1:	850407EB4C88851232D3330CA0928687E5070B81
SHA-256:	B7343A30A2BFEC09C5442AD9C67941599B7F691FFD89E38667AFC8FC5BC77050
SHA-512:	08B1E7BEB17D61E13F6A3E3AE062AB610D58C604C733F9C77563F193FA361AE6FB04551FABF2D68C4B3A69AEFD7D2CA518E391F9FFF9DEA24740B0265E78D108
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dbbb91b9bf0c42e7915e5c2627121926.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:794169YlPRd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.41056895337623
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+My2FfMOENrqjdCLKzK:qgFq6g10+f+MTFfMOEmCLAK
MD5:	5035285E0286F440BCFF9FA23CC278D1
SHA1:	A0D6F00EFAC231BA89D468AF8465846099F331BD
SHA-256:	6B8F69D2AE31FF811F99B89EFD7475716EAD4F3DD8CCCF192650322F866F8D35
SHA-512:	14CC46016480BD51802EDFE55EBC27CCB8274FAA3A1F8BFA6C37B55128EBFFC51D219B4D135A03C030B817E8ACC6779E00F1453F096F6A510B926A6F2C4B12A3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=845869ce3b0545819867c343af8ff12a.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79432ThOOFc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.394830843739646
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmv9VENshgrxsjs1Ha7:SbFuFyLVIg1BG+f+MVVAshuqjosQu
MD5:	01E1F5BB2FFF2EC2BD8260C43CE2F098
SHA1:	E0806AD1266DA3E4C830961E406375084A5BC5A3
SHA-256:	8395E61A6A10DD1CEBB33A37E6D6F98D1A9C647F74289456AA2009F56C1E3CF3
SHA-512:	194FC0B635B3008C1C0A8875B7D5977F113BF1298D122A1DBFC8510570C9BF7319AD632FB07B3B3AD73D208CB2BD6C8747A6D8A2DE90E32D8E642FCF53884417
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=efd89a0a949e4ef5ac6bf734a3b1acc3.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79439bHH83c

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.494384242729116
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu7d0mULXZjZcHcljX+:qgFq6g10+f+MYdYDmAu
MD5:	4790721B3E89A5245F2020CD14DB1650
SHA1:	C5D102B5F0E6E4684EF541BD6EA6ECD83F2DE29C
SHA-256:	256D0F6C5AF1FC759B452D12B942E33FDA99E4066EA16A7627A506F5BF958593
SHA-512:	E568A0F0B5A8FFA2A15021FC8829DFAD087D3F3D76AA7D0D379E555B953C8A1CECE62C76CEF345EB893F63C52BFEBBE7373550FDF9C6439E353C15B6ECB8912B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d09073548ddf4b27903b44e1f35f26be.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79450jxEKxe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.503621339063395
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6LSgd9vUulWQf5qjq:SbFuFyLVIg1BG+f+M6brWE0ji4s
MD5:	5C3EEC66C262F1E578CED2F2DD42E8C5
SHA1:	BCE82E83EACCB26A4EBF77C9050718A050B432C7
SHA-256:	4F86B2DF001B3AFB644C0C8F6861E8870B0EEB8CDCBFE4442A988027E07B3D4E
SHA-512:	F547309FF5AD26ADE97B82910EF7370DB0F4439C34274352ACA3E00FF700329244612C16E32901ADF45702C1E45635BBE89BF29B2B9E6F7AFA351FF85E457CFF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0177d38025484fcaae2b88cf24f4a5ff.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:79451fLJYjf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.4621406794118395
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5XNx7lBsnQ2jsicWg:SbFuFyLVIg1BG+f+Mj9jsQ2jZcHcljX+
MD5:	84D6ACEEC37CB1168977C60B9065839E
SHA1:	4F20175A1011311AFAD338B5882C6B4A1D7E64EF
SHA-256:	DF0EA55BA81167CDA6E475D90C3A3C12B9CA1D31E244B3EDC83CD7A0848EED6C
SHA-512:	A921374559DDE09CA4FF50CC8D58508B2A1A93C0FB86998FECDB35B5A8BA8CE20ED478887C46C7D2931D43048B7D1D0CA41A539F3D23CDD5B81F291A5653D9C2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=32b28e8098244aceb61ec76c078d4dbe.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:794522iemEf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.436858493422671
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm7WcRCycAAvs2rqjs2Ax:SbFuFyLVIg1BAf+M/nc1FrqjNALyAZD
MD5:	90B1C9FD39043CC15771F6F31311A439
SHA1:	58FFCF5A8B0947CFA5DB5C03765846D6DD479152
SHA-256:	CEABE5FCD258722A5B4965D765258854E0016C687DAB6BA05666447039D37B07
SHA-512:	7EB1F50F9074940EF4B6F68954C43E77A674D0FFD383F2E312220646146B93F0A7F7F7DF20349ED3E4525FED7173A76FD02DA712819DD865CABE847B236FA8CD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1bfd66750c944b199e948d7d9b0a530e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79453QgFgkg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.374776436847116
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6TjooAR2fWS0hg2j+:SbFuFyLVIg1BG+f+M6Y/TS0hTjLkGq
MD5:	2BCD5536EE6B77CD3D4F56F0B4ADE53E
SHA1:	F28EB156A0CDADF126B560EDF8325944E8D1C7D9
SHA-256:	B89E6D8C21A327E41630399011064C9DB1FE37CDD5D6BA5F31AAA4C3EBAD9EAE
SHA-512:	8CA900C303CFADC26BC0CD7622647F90CCE7E223FF96B7496C1B68A18068FAC9FD80C72FA6AF2135723F3E2240DD6AD957FF0475913495FFDCEA29BB8DC83CC9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f7ab9ba38f043ca80bca5d4bcdba337.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79454UtJNFf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.544067751658255
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyBVEcOX5HUx4Zjs77:SbFuFyLVIg1BG+f+MyBVE96x4Zji4s
MD5:	C39500E6AE40352B2CC4B9A05DB4B3F1
SHA1:	AA9581CF8F87ABDD90295590EC85D1798BC2E7E0
SHA-256:	97BDD1544C6D661C60F9DCB580C61179A7668998B5B0C87005EAD102B10FDB58
SHA-512:	343137136FF8E3E7A5AF6C51CB09F11275A626C5C057295B9B76310D9F569B1A6A8BE6B27C7FE57E00300621A8BE19CE7533F27E5EFE8D7A7288A210637CB918
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8a050a9742ec4772b93c36cc15b14248.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80693smvhqc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.456540821179919
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+Mcq42B91rqjNdQIeXD:qgFq6g1af+Mcqrrw2D
MD5:	892AE129D8DAE93AB8EABCC244A244C2
SHA1:	7A96A77FB06E7474F52376FF41C558F629998B49
SHA-256:	4F66954B8FF6D2A6A52BCAD7A34E655280048A0DD89B6B19F1797A33C6DB5BD0
SHA-512:	7E92D5018A90A2E3DEE8DEC8580BD70808DE49FF0FD1989C3A4F5E8E7C533FCAB151BA2F0EDFE3ADE53A8746E0285B9DEA35DCD132C75DF9A30DFC8FE8ABB49B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5727a7807819471ab242a5ba3427a38c.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:807226TL6Kf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.391060815991539
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmv8Di8EBqD022js2BZZD:SbFuFyLVIg1BAf+MkDZA22jNTZD
MD5:	23B9F32280A2E6B2F9104E57E4428EF0
SHA1:	AC45B77F05061BEB7B8509D4FC687A0608FB4D5E
SHA-256:	6B1CE99AB20BD6B7094C7B856587B2FA94F5C3F7F04CE4088579A6C4E3BE17FA
SHA-512:	A42F73DCF90C9D872917221DF188D2530656106ED19C8B7D648554194106D0D03085842E928B3C1211189B5BC3E80440056628F07B7D25DBB6731F940F510006
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ea0899d19db54533bb69401f5929de4f.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80817C3Ddxd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.443241177000238
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7EjuccBaWLqjswxJm:SbFuFyLVIg1BG+f+Mgj+aWWjLTTIWTIL
MD5:	16A6A7210029FB40FC0372A06442A6F9
SHA1:	147C3CDA44633206734A3739F48051896055CA37
SHA-256:	E844324B00661F62557653A38A4023D131F473F735FE8408D95EF8254C09B327
SHA-512:	8F7EF4AFDDF9840C0AB565FC77482939343E10B5EDBC761E70C6BA39EEF8E843F394E34126081852DF387BE9A6D16E504E3FA88F8482BFA90E8DCBB0E7CF185E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=114279b897dc40f28237749d38370494.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:80926cjJZHd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.3787930702288795
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzlVHsVGkDA8cxXT39:SbFuFyLVIg1BG+f+MDH8c8cbqjbVC
MD5:	6CE320EC9F8A13556EEDEEFC6791BC49
SHA1:	B5B344D81A4BD33AAB7DC6509BAF153067B13185
SHA-256:	813A58734ED67B9B393F85B3C2B57B760DBD13F1E2AC108B10ACC888F8F077BE
SHA-512:	3E09BC06114D2D12A5F74DD982C8AE8D2B681421C0E92CB105187F20D810E0184ADC8896474D3CE63A3BD2E9EFFBC544D68F979952AEE724C7D6198822982C08
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9d9870ee8ad040cbafef1d2f59e25cac.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:80971XFOQQg

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.36416096772309
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuRJCTVBAn1fBB9Q:SbFuFyLVK6g7/+BG+f+MujKATjNq
MD5:	109D8D8B1B136F33AB82F7FEE0F11DAB
SHA1:	7041BBC3303FB511D579563888E98F27F8D3C26B
SHA-256:	72642FB9C311F1B7937B5CCDC55602428C881A2A3C2C378A2805B7A0D63914FD
SHA-512:	E1E5B3CD484DE69712F41A32C04449C61C09E4C4D4A753162F6C2C51DE94BF2E36876159723617D9DACE255BDC1CD13336CC38095B943DAAA4B9E8B941671F0B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d03eb5045450460791ee93b0785dde84.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:80973WFOaPd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.408545696092596
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+Ms46VRRS/kCrZjNq:qgFqdg7/+0+f+Ms4k0/kCTq
MD5:	4EB97D5E38DA045445DB40F75147AF5A
SHA1:	E48C7DB6B99FA74EAFC8B40986560484FF319C96
SHA-256:	97F7135DBE5B711803659BBD54B2FC9F32AFCF94F04612F1CD016C29E2294596
SHA-512:	6C0B414853C9BC6D9E0B146F544BF14FD9E5D8C556F1F208FD8722BA4D462042B17A4B2787D748219CFDE313300DDB28EB78CCA6FFCA9E3CB663232C9D8E6834
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ea8a4c1f737447b98c529eb0f7cc9ee4.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81016GCOYif

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.542426556795034
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MuaUyhTjFQMzKaBu:qgFqo6g7/+0+f+MvNTmh
MD5:	01A3A9D31EF8A5C1AE8DC04FBDA36A63
SHA1:	34CAB3B0329F4A0EF4D873BBCE20F93DC7B329B3
SHA-256:	731B55062E4BE129ADBC597650725F410B37E8CBDC5E3AECC0AABF7B0A17C640
SHA-512:	CBDE22008B3C9DEA082CB3C3EA93C6051C9484536FDA6C1589700877B8566AF51A92645F1BF9A4C4A8399E6D6FF3DF90507BAD44777CB37A11F02548B4752311
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d59145f7f6db4e5a84967c4120411f2d.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81018V5AGFf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4833149038813795
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MijgVVncRqjFQMzKaBu:qgFqdg7/+0+f+MU6a4Tmh
MD5:	1602CA17D6B2588457A8B87FD3B43793
SHA1:	1F4F0DA20F1431278777E90D0A01E7FCA33CD218
SHA-256:	38FEB125475AF767B00CEA3974662D81C63DD6665F1927340F9589130CBDB16D
SHA-512:	82D9078CC3562A7D2A44CA6A99E36627B550CEF7BE72268B946328293419AFAC0CCB8CD36DBAED6A556EAAD3A77506145199D5A6F0C985761EEECFC1A009A034
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=56e30ec2cdd34147993ab20eaa225d47.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/seats/.#seat0AR8fcM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0J28FBB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Kt5wxK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0VCXLMd

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0bAnyKN

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0dvw81x

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0kYNWlM

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1270aDM6y

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30113915127719
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8GfJgBay6Ot2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEGfJgcthQHtPYq9M
MD5:	46C6C0980D9191347CFCDF65EDF92111
SHA1:	8C1340D7E0010D462E8655A834371A4209377BA9
SHA-256:	FB442D0906CFF701E972C24D1C2A530523365760115C6E981C94F80DEF4F7AF0
SHA-512:	67A6CAF1AAADF2B419E91DCFB733E6F45B30ED25DBC76EA2852D4E6226FDCB2ED3EEE5B3FF130847FE62CDF0382B5AC7A68D4262812910413FF9CB2297BD124E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14315.REALTIME=1734633938649649.MONOTONIC=584101439.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1276n3DPL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302877537786669
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffSfJgBadzjQqrSWyQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB6fJgJzW8thQHtPYqi
MD5:	565B97D2E7A479A06E4C35A3603F995A
SHA1:	1454EB02505E1890137154842D7F5BEBE4A588F7
SHA-256:	3B1BE6D9669CD5B805F346C189E349FA732FA279AB1C5108123898BDF0C2CB7C
SHA-512:	58598200555AA0A14EAC7A442D5E6C77CB3C6A21EEA05DEA0EA2D770564D27B4A1CAC74BA8EB99F0FD2D445251C70183F9EE9C7692B8D4C74C870FB6457FE62F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13517.REALTIME=1734633875740683.MONOTONIC=521192473.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278HnsZJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278lyM5B

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4828124859497125
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8pfJgBay6lt6za:qgFq30dABibBEpfJguI+
MD5:	84B2A157845D693BBC06920DDBE3918A
SHA1:	5EF55FD1A99D36AFC0AE28C33DF2CFF9AC0164FB
SHA-256:	7F2340008C7CF21164CD3B8A013ACCF449AD2096863FE02867131FC865901C9A
SHA-512:	716606E328E35A81EA14E78AAD324CFE2597E58432F006E6252E2466F5AD7C4226F2FA669274D354B6CC5DDADFC4126BA09AB9A88885351A883EF126C698EA8C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14437.REALTIME=1734633938649649.MONOTONIC=584101439.LAST_SESSION_TIMESTAMP=584208863.

/run/systemd/users/.#127B7GpKJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.475594367230265
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffpCgBadzjQqrSWOt6wn:qgFq30dABibBYgJzWOIwn
MD5:	982030BE7EEF5CA918ED90925BD60FBB
SHA1:	9A3069605855A53F6481558421E7B9FDCE5BDB72
SHA-256:	A88F4D12FC973C005EB474491018F514B89A30BFB0190C0D0EEA9E536146AA1B
SHA-512:	29D368D8CFD3AE70E1D36046343D2FC092A482EF9258090C647CB0FB5ED711E742FCD55FB3AF92E087CDFE1FF206B48237C5FDB7F7BC8D3BEAAF833E7D28A1C0
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13579.REALTIME=1734633875740683.MONOTONIC=521192473.LAST_SESSION_TIMESTAMP=521294135.

/run/systemd/users/.#127X3ooqB

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4828124859497125
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8pfJgBay6lt6za:qgFq30dABibBEpfJguI+
MD5:	84B2A157845D693BBC06920DDBE3918A
SHA1:	5EF55FD1A99D36AFC0AE28C33DF2CFF9AC0164FB
SHA-256:	7F2340008C7CF21164CD3B8A013ACCF449AD2096863FE02867131FC865901C9A
SHA-512:	716606E328E35A81EA14E78AAD324CFE2597E58432F006E6252E2466F5AD7C4226F2FA669274D354B6CC5DDADFC4126BA09AB9A88885351A883EF126C698EA8C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14437.REALTIME=1734633938649649.MONOTONIC=584101439.LAST_SESSION_TIMESTAMP=584208863.

/run/systemd/users/.#127dFStGz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.334712428638829
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgBaydTRi6V/GURWl206qodjRdk:SbFuFyL3BVgdL87iesnAiRJgBay6lt6+
MD5:	4498538CCAF49588A9795055E56EB690
SHA1:	EC0AF8C237DB2C7D2374A47B01C2DBC8C76A281A
SHA-256:	489E47904C2DA4DFC980600D36DA3EB2C82D92A69D4C2259A6AA48BB8B95739E
SHA-512:	338CD9DE3E1D9DB21D78731AC471AFD3103ED8C32EBC84D34ECDD22E58548397C19B694DC624D2A30490BFACB881D3426053C045BF1E387B5FA0276B249D9AAB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1734633938649649.MONOTONIC=584101439.LAST_SESSION_TIMESTAMP=584208863.

/run/systemd/users/.#127dry4fz

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.30113915127719
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8GfJgBay6Ot2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEGfJgcthQHtPYq9M
MD5:	46C6C0980D9191347CFCDF65EDF92111
SHA1:	8C1340D7E0010D462E8655A834371A4209377BA9
SHA-256:	FB442D0906CFF701E972C24D1C2A530523365760115C6E981C94F80DEF4F7AF0
SHA-512:	67A6CAF1AAADF2B419E91DCFB733E6F45B30ED25DBC76EA2852D4E6226FDCB2ED3EEE5B3FF130847FE62CDF0382B5AC7A68D4262812910413FF9CB2297BD124E
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14315.REALTIME=1734633938649649.MONOTONIC=584101439.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127i5iajy

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127oeoaaJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.325461621314479
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgBadzTPQqW1cSWiW6H206qodpo:SbFuFyL3BVgdL87iesnAiRJgBadzjQqw
MD5:	07E494565F76E1E3B52C89E28AE523E3
SHA1:	3560E41260CF02C0E72A6FCEC3536CDBD5093D58
SHA-256:	21591B84F9B65C0218A904793CFBDB123D6811E6E64BA4D6F0438A60B14D4582
SHA-512:	DE220CCB7C2A9C38E0D5DD5BDBC10D9D1D275295DF5FD94651D51607BB0ECAFF4A1CF61263ABDB0C97025DAEA975F51469A7366024C0823875BFA33394325C1C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1734633875740683.MONOTONIC=521192473.LAST_SESSION_TIMESTAMP=521294135.

/run/systemd/users/.#127rStqkK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.302877537786669
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffSfJgBadzjQqrSWyQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibB6fJgJzW8thQHtPYqi
MD5:	565B97D2E7A479A06E4C35A3603F995A
SHA1:	1454EB02505E1890137154842D7F5BEBE4A588F7
SHA-256:	3B1BE6D9669CD5B805F346C189E349FA732FA279AB1C5108123898BDF0C2CB7C
SHA-512:	58598200555AA0A14EAC7A442D5E6C77CB3C6A21EEA05DEA0EA2D770564D27B4A1CAC74BA8EB99F0FD2D445251C70183F9EE9C7692B8D4C74C870FB6457FE62F
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13517.REALTIME=1734633875740683.MONOTONIC=521192473.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mUcvn:mUcvn
MD5:	5118A9DB11812258ADDB2398E15EBE06
SHA1:	5824938C22C1D880C965B7ED6AEF3060E8C0AEC2
SHA-256:	571DFE4101FD0005CAE5B26EF8D1AED4445681172ECD8A8D11A8981FFA0AAFF1
SHA-512:	5118962F9C3E9BC4537357D59B4EED3188E1BB815C0B8A4E9EF88A9ED46D5D31D316FDCE3FC023864034B3E07F5ADDC0F85FEF8469641926DD681C610B60D121
Malicious:	false
Preview:	7019.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcdv:mct
MD5:	DADF6878A15804A5A26EBC5601FFF2C6
SHA1:	7F47A583FA323AC286823EA8E09AA4B500D33D00
SHA-256:	60EE0F2B254DCFEAB480274BAEC49715A20235D02D407DC020391C66A2F904C4
SHA-512:	084FF4E001296AF8CEC738C468CC50890A1261DB57DD8D6BAB02477DE5180D743EDF64889C87EDF2610F722CFF0646BAE9B87D859E9E521C121D31DE24436927
Malicious:	false
Preview:	7098.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:XAsXlXEWtl/Jlt:Xh+ylT
MD5:	7E39690342849359411F609B993E62B7
SHA1:	3653D6CCF1B8CB5D514130B73B8C961D39D440C3
SHA-256:	4783CFADC54187930B7C639BB36E629DAD53D04C4E77655DA81FD71EF2674C7E
SHA-512:	E1FAEC0606C30004915B8D8FFC9BC2A87AA33959B79A5270292A03F587BB5475D04FFCA863425EF3329C5207DED679C8C8FE62AA0FA16FD26FA670A613575C02
Malicious:	false
Preview:	....!...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................!....idgbh......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n8v:+
MD5:	D759DE7188E8D0E366A354718A8774AC
SHA1:	E0ACE2A466EAA1447C8F0287D598A078A1441C9D
SHA-256:	9A1048CA0ED398636B1883D85D9726661BC077A5302480AAD4A728556359D390
SHA-512:	F150795EE3F838A6AD63B1875B9570EF4E8DEE41225288C682FBD053AA3BBA21BD7647B0BD6B2589B0F84875A932479D217351DE937549EA90A76A1E1CA7B6AF
Malicious:	false
Preview:	7103.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mcSv:mcSv
MD5:	91FA4EF62BF300EF7E2D4C008F08CCDC
SHA1:	3028270E4DD4753959A51779D7E499F0ACBB639E
SHA-256:	83A6B9D4922D05FC7C4EC8D166887534F84476983842A559725D61B0991527F7
SHA-512:	BE3B0F4147D26439F8CA13BD36B4FA36F415AB8963F03C6D56AFD5543FDF90515DA4DE0DD187F1B11E14056C5CB7C939452470828D5ADE1ED0C4694D6CC09B78
Malicious:	false
Preview:	7097.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mdF3:m/
MD5:	205C10EA6F6E2401FB441E69BD5C08AC
SHA1:	36E055438EC4E7A0A904C9C1CBC50DF82E37A82F
SHA-256:	8A0E87E3F4FF305F55E312F38025309B9668E07AD64B20896999203F95563A16
SHA-512:	74E751E5B936BC4DD292452B1D7337782D294E3688CE1BA0B3A09E562B078371F5773BE188B3C81EF05ECAABCA631AF486BD4EF41F0D298339B35C6FA17ED1A6
Malicious:	false
Preview:	7080.7081.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcdv:mct
MD5:	DADF6878A15804A5A26EBC5601FFF2C6
SHA1:	7F47A583FA323AC286823EA8E09AA4B500D33D00
SHA-256:	60EE0F2B254DCFEAB480274BAEC49715A20235D02D407DC020391C66A2F904C4
SHA-512:	084FF4E001296AF8CEC738C468CC50890A1261DB57DD8D6BAB02477DE5180D743EDF64889C87EDF2610F722CFF0646BAE9B87D859E9E521C121D31DE24436927
Malicious:	false
Preview:	7098.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n8v:+
MD5:	D759DE7188E8D0E366A354718A8774AC
SHA1:	E0ACE2A466EAA1447C8F0287D598A078A1441C9D
SHA-256:	9A1048CA0ED398636B1883D85D9726661BC077A5302480AAD4A728556359D390
SHA-512:	F150795EE3F838A6AD63B1875B9570EF4E8DEE41225288C682FBD053AA3BBA21BD7647B0BD6B2589B0F84875A932479D217351DE937549EA90A76A1E1CA7B6AF
Malicious:	false
Preview:	7103.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:mcSv:mcSv
MD5:	91FA4EF62BF300EF7E2D4C008F08CCDC
SHA1:	3028270E4DD4753959A51779D7E499F0ACBB639E
SHA-256:	83A6B9D4922D05FC7C4EC8D166887534F84476983842A559725D61B0991527F7
SHA-512:	BE3B0F4147D26439F8CA13BD36B4FA36F415AB8963F03C6D56AFD5543FDF90515DA4DE0DD187F1B11E14056C5CB7C939452470828D5ADE1ED0C4694D6CC09B78
Malicious:	false
Preview:	7097.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:mdF3:m/
MD5:	205C10EA6F6E2401FB441E69BD5C08AC
SHA1:	36E055438EC4E7A0A904C9C1CBC50DF82E37A82F
SHA-256:	8A0E87E3F4FF305F55E312F38025309B9668E07AD64B20896999203F95563A16
SHA-512:	74E751E5B936BC4DD292452B1D7337782D294E3688CE1BA0B3A09E562B078371F5773BE188B3C81EF05ECAABCA631AF486BD4EF41F0D298339B35C6FA17ED1A6
Malicious:	false
Preview:	7080.7081.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mcdv:mct
MD5:	DADF6878A15804A5A26EBC5601FFF2C6
SHA1:	7F47A583FA323AC286823EA8E09AA4B500D33D00
SHA-256:	60EE0F2B254DCFEAB480274BAEC49715A20235D02D407DC020391C66A2F904C4
SHA-512:	084FF4E001296AF8CEC738C468CC50890A1261DB57DD8D6BAB02477DE5180D743EDF64889C87EDF2610F722CFF0646BAE9B87D859E9E521C121D31DE24436927
Malicious:	false
Preview:	7098.

/tmp/qemu-open.k24O0Y (deleted)

Download File

Process:	/tmp/wrjkngh4.elf
File Type:	data
Category:	dropped
Size (bytes):	28
Entropy (8bit):	4.137537511266052
Encrypted:	false
SSDEEP:	3:TgksX5oHJN:TgkSaJN
MD5:	500BB981854AB7530C25A26861A73B8B
SHA1:	4F653C8FC4AEC0264017DBCD5AC7E43CE9AF025B
SHA-256:	017E9ED277BB3CC9E1DCEAFF39150957AE64102C15AB6CD8926E92F818E9EEE3
SHA-512:	4C0F5BBD326252A5B45BABD6797837E9E838A3F81D451963FFE54D63B484E1E610474F85DA66F49E9681F8074CCB4A0AD2034572C01766F303E68DBDE45230C1
Malicious:	false
Preview:	/tmp/wrjkngh4.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.JOYWY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.U2EYY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.934480220020942
Encrypted:	false
SSDEEP:	12:MeFBZPaV5pM2FfG2FTGFInMWF0AvmjF0A2+VAFeEF0hLad1EFBT4p1WrgEFkHWXA:vZea+GWHnGAv1A2+Vf0pYry5JrOrCQU
MD5:	80FDF15900D706DABAC7A8B5EF1A1596
SHA1:	74E124B6869CE16BA2B2390AAAAA888E4D8DA464
SHA-256:	16D6AB3F0EE6CBE4E4D2C309BE47D5193BB5A0495860AD6AD0D287902E98A783
SHA-512:	D97191F038773072145F77033D1B60A5368B5E5E1AECE5D5583164DAE38E706C35A50D5B89CF440269DABEC33A135486E3ED499B41427AD4DA468B6805F35F28
Malicious:	false
Preview:	Dec 19 12:45:23 galassia systemd-logind[6948]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 19 12:45:24 galassia systemd-logind[6948]: User enumeration failed: Invalid argument.Dec 19 12:45:24 galassia systemd-logind[6948]: User of session 2 not known..Dec 19 12:45:24 galassia systemd-logind[6948]: Session enumeration failed: No such file or directory.Dec 19 12:45:24 galassia systemd-logind[6948]: Watching system buttons on /dev/input/event0 (Power Button).Dec 19 12:45:24 galassia systemd-logind[6948]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 19 12:45:24 galassia systemd-logind[6948]: New seat seat0..Dec 19 12:45:38 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 19 12:45:38 galassia systemd-logind[6948]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Dec 19 12:45:38 galassia systemd: pam_unix(systemd-user:session):

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlhoApm7wO/zoApm7we:F3RoJ/LoJ/
MD5:	9E33DA568013E7ADB4827FD15914E350
SHA1:	2C0BAB46F2EDE71A488E5F78DC11AB39E5DFA9BE
SHA-256:	72CF6548630B6A9E5EEE3A68025A9CFFB3417DA06624E0A1863BE828F6463613
SHA-512:	A78F3C1193B24F54C7590279DB6D925F5A9ABC80BA3C03F70C08F3C3EF67B9275B1511D0CE7D055FB2562C6A44F4B0DD0F97EE5DFA44FCCF86A9F445B0A21E3A
Malicious:	false
Preview:	LPKSHHRH................\|gy.Me...w....................................\|gy.Me...w............................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlodXledV/t:F344
MD5:	06375AAA28BB6E9CE7BBA29335BBA12C
SHA1:	71AAFB1B587566E72A1FB4C4BF822B1F26FA65E9
SHA-256:	6953923A0A954F15F92C3C5202E3BB8775F4CB7C96B4DFD130F63B1396BBCF06
SHA-512:	E0409BEEDD0B64149E01B00847E0C0ED5675E8554ABD5F3713019DC09402EA2AAFEACFD016D56105B7B303B331ED9F9799D8CF5C1C12D8C8B72E5D1EC37F9219
Malicious:	false
Preview:	LPKSHHRH.....................o@p...{)........................................o@p...{)...........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12313
Entropy (8bit):	4.960058913293209
Encrypted:	false
SSDEEP:	96:wftvt2c4YF3JGKDOfGOhSYYHl5JPfEf/0ftSbjfxUegwEbtrjhTo7/yzFAKmLLsQ:EahQyXAYflYr8Q1b2qvArYNr5KJ
MD5:	5A8B8B6C3ABAD8883EC0B653BC20A59D
SHA1:	33C08EB5749389FDB8D362A418A7FC9A6EBE7103
SHA-256:	F087810D1B21B759A22F30262C6193C8EA74B61B6797C9A758B5264E6364954E
SHA-512:	23BB91ED9C38A6B9D7952E401B50AB2453D458D6D14AF8A5C87561A425F5CEC125276406A0F6550BE8184EA8153AAE2FD27FA1ECBF8BBF7B784FA1FFD0A79B37
Malicious:	false
Preview:	Dec 19 12:45:12 galassia kernel: [ 557.207147] blocking signal 9: 6230 -> 658.Dec 19 12:45:12 galassia kernel: [ 557.210750] blocking signal 9: 6230 -> 720.Dec 19 12:45:12 galassia kernel: [ 557.216647] blocking signal 9: 6230 -> 772.Dec 19 12:45:12 galassia kernel: [ 557.220686] blocking signal 9: 6230 -> 936.Dec 19 12:45:12 galassia kernel: [ 557.222457] blocking signal 9: 6230 -> 2048.Dec 19 12:45:12 galassia kernel: [ 557.860718] New task spawned: old: (tgid 7005, tid 7005), new (tgid: 7005, tid: 7010).Dec 19 12:45:12 galassia kernel: [ 557.861710] New task spawned: old: (tgid 7005, tid 7005), new (tgid: 7005, tid: 7011).Dec 19 12:45:12 galassia kernel: [ 557.875591] New task spawned: old: (tgid 7005, tid 7011), new (tgid: 7005, tid: 7012).Dec 19 12:45:12 galassia kernel: [ 558.135824] Reached call limit: pid 6230, name openat.Dec 19 12:45:14 galassia kernel: [ 558.332661] New task spawned: old: (tgid 7006, tid 7006), new (tgid: 7006, tid: 7014).Dec 19 12:45:14 galassia k

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	30571
Entropy (8bit):	5.12339457833209
Encrypted:	false
SSDEEP:	768:+JheshD/B1D/Bbd1JX34fTJ1r3FxDGheK41zfhx+vjdOnrp2cQyr:IhesHCR/
MD5:	A1B95917E9267408D1E6A9836A1A8169
SHA1:	61D9A35801CE533F557C1A9D53AD00524AAD17B5
SHA-256:	DD02681E41CB6651DE41181659CB39EB28FF51D632081E0A560885D30DFAB60D
SHA-512:	B21FC1C53DADC5CECBCE8B53CAB228D5FA7CF6BF676B5F141678F6994EEB5C6EB59091B17D1758625078ED57F0E8F0583E903860F65832A0CA57CFFB8DC7D8DC
Malicious:	false
Preview:	Dec 19 12:45:12 galassia kernel: [ 557.161652] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 19 12:45:12 galassia kernel: [ 557.161742] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 19 12:45:12 galassia kernel: [ 557.207147] blocking signal 9: 6230 -> 658.Dec 19 12:45:12 galassia kernel: [ 557.210750] blocking signal 9: 6230 -> 720.Dec 19 12:45:12 galassia kernel: [ 557.213297] systemd[1]: accounts-daemon.service: Succeeded..Dec 19 12:45:12 galassia kernel: [ 557.216464] systemd[1]: systemd-logind.service: Main process exited, code=killed, status=9/KILL.Dec 19 12:45:12 galassia kernel: [ 557.216647] blocking signal 9: 6230 -> 772.Dec 19 12:45:12 galassia kernel: [ 557.216769] systemd[1]: systemd-logind.service: Failed with result 'signal'..Dec 19 12:45:12 galassia kernel: [ 557.219312] systemd[1]: systemd-logind.service: Scheduled restart job, restart counter is at 5..Dec 19 12:45:12 galassia kernel: [ 557.219322] systemd[1]:

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:XAsXlXEWtl/Jlt:Xh+ylT
MD5:	7E39690342849359411F609B993E62B7
SHA1:	3653D6CCF1B8CB5D514130B73B8C961D39D440C3
SHA-256:	4783CFADC54187930B7C639BB36E629DAD53D04C4E77655DA81FD71EF2674C7E
SHA-512:	E1FAEC0606C30004915B8D8FFC9BC2A87AA33959B79A5270292A03F587BB5475D04FFCA863425EF3329C5207DED679C8C8FE62AA0FA16FD26FA670A613575C02
Malicious:	true
Preview:	....!...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................!....idgbh......................................

Source: global traffic	TCP traffic: 192.168.2.23:50010 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:38184 -> 178.215.238.25:33966

File type:	ELF 32-bit LSB executable, Renesas SH, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	6.357418810107009
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wrjkngh4.elf
File size:	142'144 bytes
MD5:	820dac361dea90d7449d2a86e75ab92b
SHA1:	4775a5d3f3ef2b55211896d3a4dbebd78574b0e7
SHA256:	251cd8966aec6f6576dee6948760642c2dfe4f23f570d022ff6846af35ff09ce
SHA512:	9d1fd6a9f54b4777d453f91e8fec3bd0edd60e311ad5c1bb18644bdf9d31247b3dfa02d2655669aaa699dab995d58a7f67f50f457a99937fde3a8a2d3f54c1c6
SSDEEP:	3072:73yWOGE9XwxDGdZc00JYNMv8EpXvWWNaPa3Ks:73yXpAcZc00e/y+WMa3Ks
TLSH:	3CD36B73D83AAF98C655D1B0B030CF782F53969186472FBA69E6C2B44443D8CF615BB8
File Content Preview:	.ELF.....................@.4....)......4. ...(...............@...@.`...`.....................B...B.DI..(...........Q.td............................././"O.n........#.@........#.*@l....o&O.n...l..............................././.../.a"O.!...n...a.b("...q.

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	<unknown>
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x4001a0
Flags:	0x9
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	141704
Section Header Size:	40
Number of Section Headers:	11
Header String Table Index:	10

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x30	0x0	0x6	AX	4
.text	PROGBITS	0x4000e0	0xe0	0x1ad80	0x0	0x6	AX	32
.fini	PROGBITS	0x41ae60	0x1ae60	0x24	0x0	0x6	AX	4
.rodata	PROGBITS	0x41ae84	0x1ae84	0x30dc	0x0	0x2	A	4
.ctors	PROGBITS	0x42e000	0x1e000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x42e00c	0x1e00c	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x42e020	0x1e020	0x4910	0x0	0x3	WA	32
.got	PROGBITS	0x432930	0x22930	0x14	0x4	0x3	WA	4
.bss	NOBITS	0x432944	0x22944	0x45e4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x22944	0x43	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1df60	0x1df60	6.9156	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x1e000	0x42e000	0x42e000	0x4944	0x8f28	0.4272	0x6	RW	0x10000	.ctors .dtors .data .got .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 19, 2024 19:43:39.104238033 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 19, 2024 19:44:59.118171930 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 19, 2024 19:42:50.910824060 CET	8.8.8.8	192.168.2.23	0xd3bd	No error (0)	raw.cardiacpure.ru	178.215.238.25	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:41.544162035 CET	1.1.1.1	192.168.2.23	0xfc0f	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:43:41.544162035 CET	1.1.1.1	192.168.2.23	0xfc0f	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:45:17.683720112 CET	1.1.1.1	192.168.2.23	0xe413	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 19, 2024 19:45:17.683720112 CET	1.1.1.1	192.168.2.23	0xe413	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-19 18:43:47 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-19 18:43:47 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-19 18:43:47 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-19 18:43:48 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 19 Dec 2024 18:43:48 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	18:42:40
Start date (UTC):	19/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:42:49
Start date (UTC):	19/12/2024
Path:	/tmp/wrjkngh4.elf
Arguments:	/tmp/wrjkngh4.elf
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	18:42:52
Start date (UTC):	19/12/2024
Path:	/tmp/wrjkngh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	18:44:16
Start date (UTC):	19/12/2024
Path:	/tmp/wrjkngh4.elf
Arguments:	-
File size:	4139976 bytes
MD5 hash:	8943e5f8f8c280467b4472c15ae93ba9

Start time (UTC):	18:42:50
Start date (UTC):	19/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	18:42:51
Start date (UTC):	19/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:43:32
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:34
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:37
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:38
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:39
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:40
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wrjkngh4.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6924/oom_score_adj

/proc/7089/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:2470784CyCUE2

/run/systemd/journal/streams/.#9:2470847vXrbm1

/run/systemd/journal/streams/.#9:2470849xYopv3

/run/systemd/journal/streams/.#9:2618138f9hkF2

/run/systemd/journal/streams/.#9:3021972Zxxn72

/run/systemd/journal/streams/.#9:3022586vkgGq3

/run/systemd/journal/streams/.#9:3022588WoQeZZ

/run/systemd/journal/streams/.#9:3189942AO8qE0

/run/systemd/journal/streams/.#9:3189989tQGXD2

/run/systemd/journal/streams/.#9:3190109ygNfp1

/run/systemd/journal/streams/.#9:473547sgu7OZ

/run/systemd/journal/streams/.#9:473557D33Vj3

/run/systemd/journal/streams/.#9:473558Vgoct1

/run/systemd/journal/streams/.#9:4735594xciW1

/run/systemd/journal/streams/.#9:473569xmMZq3

/run/systemd/journal/streams/.#9:473576JOdIB0

/run/systemd/journal/streams/.#9:473577DawrM2

/run/systemd/journal/streams/.#9:473586iiuXBZ

Linux Analysis Report
wrjkngh4.elf

Start time (UTC):	18:43:41
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:42
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:43
Start date (UTC):	19/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:43:44
Start date (UTC):	19/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	18:43:45
Start date (UTC):	19/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	18:43:46
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:47
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:57
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	18:43:58
Start date (UTC):	19/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	18:43:59
Start date (UTC):	19/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f