Edit tour

Linux Analysis Report
wiewa64.elf

Overview

General Information

Sample name:	wiewa64.elf
Analysis ID:	1578525
MD5:	54b9ab4ddfac7f9e5775ee57d8007fa5
SHA1:	89cae32bcd35b0738b12c7cbdb9ee996d87bcd7d
SHA256:	dca359aa16005da260dac76d5baec9360796211eff6e31341b5112dbc91e7fca
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Machine Learning detection for sample

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578525
Start date and time:	2024-12-19 21:07:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wiewa64.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/146@87/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: wiewa64.elf

Runtime Messages

Command:	/tmp/wiewa64.elf
PID:	6208
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

wiewa64.elf (PID: 6208, Parent: 6127, MD5: 54b9ab4ddfac7f9e5775ee57d8007fa5) Arguments: /tmp/wiewa64.elf

wiewa64.elf New Fork (PID: 6209, Parent: 6208)

wiewa64.elf New Fork (PID: 6210, Parent: 6209)

wiewa64.elf New Fork (PID: 6240, Parent: 6210)

sh (PID: 6240, Parent: 6210, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6241, Parent: 6240)

ps (PID: 6241, Parent: 6240, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

wiewa64.elf New Fork (PID: 6705, Parent: 6210)

sh (PID: 6705, Parent: 6210, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6706, Parent: 6705)

ps (PID: 6706, Parent: 6705, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6211, Parent: 1477)

sh (PID: 6211, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6211, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

gdm3 New Fork (PID: 6216, Parent: 1320)

Default (PID: 6216, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6237, Parent: 1320)

Default (PID: 6237, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6277, Parent: 1)

journalctl (PID: 6277, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6295, Parent: 1)

systemd-journald (PID: 6295, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6298, Parent: 1)

journalctl (PID: 6298, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6305, Parent: 1)

dbus-daemon (PID: 6305, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6314, Parent: 1320)

Default (PID: 6314, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6319, Parent: 1860)

pulseaudio (PID: 6319, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6320, Parent: 1)

rsyslogd (PID: 6320, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6328, Parent: 1)

systemd-logind (PID: 6328, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6387, Parent: 1)

rtkit-daemon (PID: 6387, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6391, Parent: 1)

polkitd (PID: 6391, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6392, Parent: 1)

gpu-manager (PID: 6392, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6396, Parent: 6392)

sh (PID: 6396, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6397, Parent: 6396)

grep (PID: 6397, Parent: 6396, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6399, Parent: 6392)

sh (PID: 6399, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6400, Parent: 6399)

grep (PID: 6400, Parent: 6399, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6402, Parent: 6392)

sh (PID: 6402, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6405, Parent: 6402)

grep (PID: 6405, Parent: 6402, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6406, Parent: 6392)

sh (PID: 6406, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6407, Parent: 6406)

grep (PID: 6407, Parent: 6406, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6408, Parent: 6392)

sh (PID: 6408, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6409, Parent: 6408)

grep (PID: 6409, Parent: 6408, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6410, Parent: 6392)

sh (PID: 6410, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6411, Parent: 6410)

grep (PID: 6411, Parent: 6410, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6416, Parent: 6392)

sh (PID: 6416, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6418, Parent: 6392)

sh (PID: 6418, Parent: 6392, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6419, Parent: 6418)

grep (PID: 6419, Parent: 6418, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6401, Parent: 1)

agetty (PID: 6401, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gvfsd-fuse New Fork (PID: 6412, Parent: 2038)

fusermount (PID: 6412, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6422, Parent: 1)

generate-config (PID: 6422, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6423, Parent: 6422)

pkill (PID: 6423, Parent: 6422, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6426, Parent: 1)

gdm-wait-for-drm (PID: 6426, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6432, Parent: 1)

gdm3 (PID: 6432, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6435, Parent: 6432)

plymouth (PID: 6435, Parent: 6432, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

systemd New Fork (PID: 6436, Parent: 1)

accounts-daemon (PID: 6436, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6440, Parent: 6436)

language-validate (PID: 6440, Parent: 6436, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6441, Parent: 6440)

language-options (PID: 6441, Parent: 6440, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6442, Parent: 6441)

sh (PID: 6442, Parent: 6441, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6443, Parent: 6442)

locale (PID: 6443, Parent: 6442, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6444, Parent: 6442)

grep (PID: 6444, Parent: 6442, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6446, Parent: 1)

agetty (PID: 6446, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6447, Parent: 1)

rsyslogd (PID: 6447, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6452, Parent: 1)

gpu-manager (PID: 6452, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6453, Parent: 6452)

sh (PID: 6453, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6454, Parent: 6453)

grep (PID: 6454, Parent: 6453, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6457, Parent: 6452)

sh (PID: 6457, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6458, Parent: 6457)

grep (PID: 6458, Parent: 6457, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6459, Parent: 6452)

sh (PID: 6459, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6460, Parent: 6459)

grep (PID: 6460, Parent: 6459, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6461, Parent: 6452)

sh (PID: 6461, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6462, Parent: 6461)

grep (PID: 6462, Parent: 6461, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6465, Parent: 6452)

sh (PID: 6465, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6466, Parent: 6465)

grep (PID: 6466, Parent: 6465, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6467, Parent: 6452)

sh (PID: 6467, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6468, Parent: 6467)

grep (PID: 6468, Parent: 6467, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6469, Parent: 6452)

sh (PID: 6469, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6470, Parent: 6469)

grep (PID: 6470, Parent: 6469, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6472, Parent: 6452)

sh (PID: 6472, Parent: 6452, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6532, Parent: 6472)

grep (PID: 6532, Parent: 6472, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6456, Parent: 1)

dbus-daemon (PID: 6456, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6475, Parent: 1)

systemd-logind (PID: 6475, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6535, Parent: 1)

generate-config (PID: 6535, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6536, Parent: 6535)

pkill (PID: 6536, Parent: 6535, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6537, Parent: 1)

gdm-wait-for-drm (PID: 6537, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6541, Parent: 1)

rsyslogd (PID: 6541, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6548, Parent: 1)

dbus-daemon (PID: 6548, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6549, Parent: 1)

rsyslogd (PID: 6549, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6560, Parent: 1)

systemd-logind (PID: 6560, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6617, Parent: 1)

journalctl (PID: 6617, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6618, Parent: 1)

systemd-journald (PID: 6618, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6620, Parent: 1)

rsyslogd (PID: 6620, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6623, Parent: 1)

systemd-logind (PID: 6623, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6681, Parent: 1)

systemd-journald (PID: 6681, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6685, Parent: 1)

agetty (PID: 6685, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6686, Parent: 1)

gpu-manager (PID: 6686, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6687, Parent: 6686)

sh (PID: 6687, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6689, Parent: 6687)

grep (PID: 6689, Parent: 6687, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6693, Parent: 6686)

sh (PID: 6693, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6694, Parent: 6693)

grep (PID: 6694, Parent: 6693, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6695, Parent: 6686)

sh (PID: 6695, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6696, Parent: 6695)

grep (PID: 6696, Parent: 6695, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6697, Parent: 6686)

sh (PID: 6697, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6698, Parent: 6697)

grep (PID: 6698, Parent: 6697, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6699, Parent: 6686)

sh (PID: 6699, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6700, Parent: 6699)

grep (PID: 6700, Parent: 6699, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6701, Parent: 6686)

sh (PID: 6701, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6702, Parent: 6701)

grep (PID: 6702, Parent: 6701, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6707, Parent: 6686)

sh (PID: 6707, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6709, Parent: 6707)

grep (PID: 6709, Parent: 6707, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6710, Parent: 6686)

sh (PID: 6710, Parent: 6686, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6711, Parent: 6710)

grep (PID: 6711, Parent: 6710, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6690, Parent: 1)

dbus-daemon (PID: 6690, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6714, Parent: 1)

generate-config (PID: 6714, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6715, Parent: 6714)

pkill (PID: 6715, Parent: 6714, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6716, Parent: 1)

gdm-wait-for-drm (PID: 6716, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6721, Parent: 1)

gdm3 (PID: 6721, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6724, Parent: 6721)

plymouth (PID: 6724, Parent: 6721, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6740, Parent: 6721)

gdm-session-worker (PID: 6740, Parent: 6721, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6744, Parent: 6740)

gdm-wayland-session (PID: 6744, Parent: 6740, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6746, Parent: 6744)

dbus-daemon (PID: 6746, Parent: 6744, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6748, Parent: 6746)

dbus-daemon New Fork (PID: 6749, Parent: 6748)

false (PID: 6749, Parent: 6748, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6750, Parent: 6744)

dbus-run-session (PID: 6750, Parent: 6744, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6751, Parent: 6750)

dbus-daemon (PID: 6751, Parent: 6750, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6754, Parent: 6721)

Default (PID: 6754, Parent: 6721, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6755, Parent: 6721)

Default (PID: 6755, Parent: 6721, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6725, Parent: 1)

accounts-daemon (PID: 6725, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6729, Parent: 6725)

language-validate (PID: 6729, Parent: 6725, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6730, Parent: 6729)

language-options (PID: 6730, Parent: 6729, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6731, Parent: 6730)

sh (PID: 6731, Parent: 6730, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6732, Parent: 6731)

locale (PID: 6732, Parent: 6731, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6733, Parent: 6731)

grep (PID: 6733, Parent: 6731, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6736, Parent: 1)

polkitd (PID: 6736, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6769, Parent: 1860)

dbus-daemon (PID: 6769, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6770, Parent: 1860)

pulseaudio (PID: 6770, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6771, Parent: 1)

rtkit-daemon (PID: 6771, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6776, Parent: 1)

systemd-journald (PID: 6776, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6779, Parent: 1)

systemd-logind (PID: 6779, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6789, Parent: 1)

agetty (PID: 6789, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6805, Parent: 1)

rsyslogd (PID: 6805, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6811, Parent: 1)

dbus-daemon (PID: 6811, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6840, Parent: 1)

dbus-daemon (PID: 6840, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6841, Parent: 1)

rsyslogd (PID: 6841, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6843, Parent: 1860)

pulseaudio (PID: 6843, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6844, Parent: 1)

gpu-manager (PID: 6844, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6850, Parent: 6844)

sh (PID: 6850, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6851, Parent: 6850)

grep (PID: 6851, Parent: 6850, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6853, Parent: 6844)

sh (PID: 6853, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6854, Parent: 6853)

grep (PID: 6854, Parent: 6853, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6855, Parent: 6844)

sh (PID: 6855, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6856, Parent: 6855)

grep (PID: 6856, Parent: 6855, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6859, Parent: 6844)

sh (PID: 6859, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6860, Parent: 6859)

grep (PID: 6860, Parent: 6859, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6865, Parent: 6844)

sh (PID: 6865, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6866, Parent: 6865)

grep (PID: 6866, Parent: 6865, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6870, Parent: 6844)

sh (PID: 6870, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6871, Parent: 6870)

grep (PID: 6871, Parent: 6870, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6872, Parent: 6844)

sh (PID: 6872, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6873, Parent: 6872)

grep (PID: 6873, Parent: 6872, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6876, Parent: 6844)

sh (PID: 6876, Parent: 6844, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6877, Parent: 6876)

grep (PID: 6877, Parent: 6876, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6858, Parent: 1)

rtkit-daemon (PID: 6858, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6864, Parent: 1)

polkitd (PID: 6864, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6878, Parent: 1)

generate-config (PID: 6878, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6879, Parent: 6878)

pkill (PID: 6879, Parent: 6878, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6884, Parent: 1860)

dbus-daemon (PID: 6884, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6885, Parent: 1)

gdm-wait-for-drm (PID: 6885, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6890, Parent: 1)

gdm3 (PID: 6890, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6893, Parent: 6890)

plymouth (PID: 6893, Parent: 6890, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6903, Parent: 6890)

gdm-session-worker (PID: 6903, Parent: 6890, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6911, Parent: 6903)

gdm-wayland-session (PID: 6911, Parent: 6903, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6913, Parent: 6911)

dbus-daemon (PID: 6913, Parent: 6911, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6917, Parent: 6913)

dbus-daemon New Fork (PID: 6918, Parent: 6917)

false (PID: 6918, Parent: 6917, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6919, Parent: 6911)

dbus-run-session (PID: 6919, Parent: 6911, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6920, Parent: 6919)

dbus-daemon (PID: 6920, Parent: 6919, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6924, Parent: 6890)

Default (PID: 6924, Parent: 6890, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6925, Parent: 6890)

Default (PID: 6925, Parent: 6890, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6894, Parent: 1)

accounts-daemon (PID: 6894, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6898, Parent: 6894)

language-validate (PID: 6898, Parent: 6894, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6899, Parent: 6898)

language-options (PID: 6899, Parent: 6898, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6900, Parent: 6899)

sh (PID: 6900, Parent: 6899, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6901, Parent: 6900)

locale (PID: 6901, Parent: 6900, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6902, Parent: 6900)

grep (PID: 6902, Parent: 6900, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6909, Parent: 1)

systemd (PID: 6909, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 6914, Parent: 6909)

systemd New Fork (PID: 6915, Parent: 6914)

30-systemd-environment-d-generator (PID: 6915, Parent: 6914, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 6926, Parent: 6909)

systemctl (PID: 6926, Parent: 6909, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 6927, Parent: 6909)

pulseaudio (PID: 6927, Parent: 6909, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wiewa64.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wiewa64.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1bda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1beb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1becc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bf08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bf1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bf30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
wiewa64.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x11a4c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
wiewa64.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x122c3:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
wiewa64.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe176:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe368:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
wiewa64.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1602a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
wiewa64.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1ae76:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
wiewa64.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x11e83:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
wiewa64.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x10d82:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
wiewa64.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x1214e:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
wiewa64.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x10f7b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
wiewa64.elf	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
wiewa64.elf	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
wiewa64.elf	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x67b2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Click to see the 9 entries

Memory Dumps

Source	Rule	Description	Author	Strings
6208.1.0000000000400000.0000000000420000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1bda0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bdb4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bdc8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bddc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bdf0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be04:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be18:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be2c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be40:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be54:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be68:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be7c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1be90:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bea4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1beb8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1becc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bee0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bef4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bf08:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bf1c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1bf30:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0x11a4c:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0x122c3:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0xe176:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0xe368:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0x1602a:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x1ae76:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0x11e83:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x10d82:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0x1214e:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x10f7b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_520deeb8	unknown	unknown	0x38a:$a: ED 48 89 44 24 30 44 89 6C 24 10 7E 47 48 89 C1 44 89 E8 44
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_01e4a728	unknown	unknown	0x48d:$a: 44 24 23 48 8B 6C 24 28 83 F9 01 4A 8D 14 20 0F B6 02 88 45 08
6208.1.0000000000400000.0000000000420000.r-x.sdmp	Linux_Trojan_Mirai_e0cf29e2	unknown	unknown	0x67b2:$a: 83 FE 01 76 12 0F B7 07 83 EE 02 48 83 C7 02 48 01 C2 83 FE 01
Process Memory Space: wiewa64.elf PID: 6208	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wiewa64.elf PID: 6208	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0xa9a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaae:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xac2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xad6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xaea:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xafe:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb12:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb26:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb3a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb4e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb62:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb76:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb8a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xb9e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbb2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbc6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbda:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xbee:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc02:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc16:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0xc2a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Click to see the 11 entries

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6320)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6447)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6541)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6549)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6620)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6841)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6295)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6618)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6681)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6721)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6746)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6776)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6890)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6913)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6920)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 6909)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.41.dr, syslog.179.dr, syslog.113.dr, syslog.290.dr, syslog.163.dr, syslog.169.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53884
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 Author: unknown
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 Author: unknown
Source: Process Memory Space: wiewa64.elf PID: 6208, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4468, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4471, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4500, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6037, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6159, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6217, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6218, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6219, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6220, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6305, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6401, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6440, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6445, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6446, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6447, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6448, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6540, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6540, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6541, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6542, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6537, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6546, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6548, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6549, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6552, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6560, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6618, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6619, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6192, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6319, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6534, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6620, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6623, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6681, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6685, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6690, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6705, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6706, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6721, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6769, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: ]BusyBoxps:/proc/%d/exe/proc/%d/maps/var/run/mnt/root/var/tmp/boot/bin/sbin/../(deleted)/homedbgmpslmipselmipsarmarm4arm5arm6arm7sh4m68kx86x586x86_64i586i686ppcspc[locker] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6211, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4468, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4471, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 4500, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6037, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6159, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6167, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6192, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6217, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6218, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6219, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6220, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6305, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6319, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6320, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6401, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6440, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6445, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6446, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6447, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6448, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6540, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6540, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6541, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6542, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6295, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6537, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6546, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6548, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6549, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6552, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6560, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6618, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6619, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6192, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6318, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6319, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6534, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6620, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6623, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6624, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6681, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6685, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6690, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6705, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6706, result: no such process	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6721, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6769, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6770, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6805, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6210)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior

Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: wiewa64.elf, type: SAMPLE	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_520deeb8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f4dfd1d76e07ff875eedfe0ef4f861bee1e4d8e66d68385f602f29cc35e30cca, id = 520deeb8-cbc0-4225-8d23-adba5e040471, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_01e4a728 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d90477364982bdc6cd22079c245d866454475749f762620273091f2fab73c196, id = 01e4a728-7c1c-479b-aed0-cb76d64dbb02, last_modified = 2021-09-16
Source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_e0cf29e2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3f124c3c9f124264dfbbcca1e4b4d7cfcf3274170d4bf8966b6559045873948f, id = e0cf29e2-88d7-4aa4-b60a-c24626f2b246, last_modified = 2021-09-16
Source: Process Memory Space: wiewa64.elf PID: 6208, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/146@87/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6305)	File: /proc/6305/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6412)	File: /proc/6412/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6456)	File: /proc/6456/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6548)	File: /proc/6548/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6690)	File: /proc/6690/mounts
Source: /usr/bin/dbus-daemon (PID: 6746)	File: /proc/6746/mounts
Source: /usr/bin/dbus-daemon (PID: 6751)	File: /proc/6751/mounts
Source: /usr/bin/dbus-daemon (PID: 6769)	File: /proc/6769/mounts
Source: /usr/bin/dbus-daemon (PID: 6840)	File: /proc/6840/mounts
Source: /usr/bin/dbus-daemon (PID: 6884)	File: /proc/6884/mounts
Source: /usr/bin/dbus-daemon (PID: 6913)	File: /proc/6913/mounts
Source: /usr/bin/dbus-daemon (PID: 6920)	File: /proc/6920/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6211)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6211)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:754590Iyyra	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:75461AwhpOd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:76245XQpXHc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:76261t6uCHa	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:76268supiHc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:76473bu4Hja	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:764748cvj9a	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:76592Vio6Jd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:767906tL26c	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:76791HwN2Vb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:779484aacmb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78033bZ204d	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78175OmREje	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78281VGLXjb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78312pBZgbe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78336mWtnQd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:784442DV0hd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78479LtZqGd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78497MVMW7c	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78575pzqrMd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78649jqtNQd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:7873829BcOc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:78771xRTHuc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File: /run/systemd/journal/streams/.#9:79884rqdZ8a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6328)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6328)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6328)	File: /run/systemd/seats/.#seat00V1agH	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6391)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6436)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6475)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6475)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6475)	File: /run/systemd/seats/.#seat0Iwj9bO	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/seats/.#seat0UMzX2X	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/users/.#1273ri4h1	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/users/.#127TY4z0Y	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/seats/.#seat01toe70	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/users/.#127PocM4Z	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/users/.#1278vPBq0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/users/.#127Cj4lX0	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6623)	File: /run/systemd/users/.#127c4nhwY	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80654SHY9mn
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80732YNEZ6l
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80733uCXTAp
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:8073409beim
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80740oAelVm
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80748ECIc0l
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80749v8T40p
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80830agTWtm
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:80933hXRNOo
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:81038gcyHWl
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:81085crO5Pm
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:81087HXNwVp
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:8112764JG7m
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:81129gXIjAm
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:812314nul9p
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:81280PKTxKm
Source: /lib/systemd/systemd-journald (PID: 6681)	File: /run/systemd/journal/streams/.#9:81294OmNwrn
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6744)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6725)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6725)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6736)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:1333238DggQQx
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:1333243vKJcmA
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:1333247w4YL9A
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:2773000nChlxA
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:2773002cUL30A
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:2773088JfGNYA
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:2773090vQIxky
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:27731040dx0hz
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:2773105ZIbEDy
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:2773106EPLG6w
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:27731071lWCty
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:2773108zBnQzB
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:5206052tEBqnA
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:5253594s8hVBz
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:5268347FwYb0z
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:5268349MrEKCz
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:60570972UHEPy
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:6127343wjUCZx
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:6131738RTD8yB
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:7362381gHD9wz
Source: /lib/systemd/systemd-journald (PID: 6776)	File: /run/systemd/journal/streams/.#9:7362428KP3GNx
Source: /lib/systemd/systemd-logind (PID: 6779)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6779)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/seats/.#seat0D0r3YO
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/users/.#127B7gjlO
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/users/.#127XZRt2O
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/seats/.#seat0rLyPjO
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/users/.#127PhId2L
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/users/.#127mq20NL
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/users/.#127Yo07ON
Source: /lib/systemd/systemd-logind (PID: 6779)	File: /run/systemd/users/.#127nOjECL
Source: /usr/lib/policykit-1/polkitd (PID: 6864)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6911)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 6909)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 6915)	Directory: <invalid fd (4)>/.config

Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6432/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6432/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6432/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6432/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6432/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6432/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6432/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6475/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6475/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6475/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6475/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6475/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6475/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6475/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6552/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6552/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6552/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6552/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6552/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6552/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6552/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2078/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2078/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2078/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2078/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2078/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2078/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2078/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2077/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2077/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2077/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2077/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2077/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2077/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2077/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2033/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2033/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2033/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2033/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2033/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2033/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2033/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2074/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2074/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2074/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2074/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2074/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2074/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2074/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6391/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6391/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6391/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6391/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6391/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6391/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/6391/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2028/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/1334/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/1334/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/1334/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/1334/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/1334/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/1334/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2302/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2302/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2302/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2302/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2302/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2302/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/797/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/797/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/797/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/797/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/797/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/797/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/797/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2025/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2025/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2025/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2025/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2025/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2025/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2025/cgroup	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2223/comm	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2223/cmdline	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2223/status	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2223/attr/current	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2223/sessionid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2223/loginuid	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	File opened: /proc/2223/cgroup	Jump to behavior

Source: /tmp/wiewa64.elf (PID: 6240)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/wiewa64.elf (PID: 6705)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6396)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6399)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6402)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6406)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6408)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6410)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6418)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6442)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6453)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6457)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6459)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6461)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6465)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6467)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6469)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6472)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6687)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6693)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6695)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6697)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6699)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6701)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6707)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6710)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6731)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 6850)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6853)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6855)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6859)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6865)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6870)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6872)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6876)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6900)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6397)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6400)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6405)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6407)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6409)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6411)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6419)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6444)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6454)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6458)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6460)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6462)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6466)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6468)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6470)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6532)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6689)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6694)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6696)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6698)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6700)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6702)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6709)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6711)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6733)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 6851)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6854)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6856)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6860)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6866)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6871)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6873)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6877)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6902)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6423)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6536)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6715)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 6879)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6241)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6706)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 6926)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6241)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6706)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6295)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6618)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6681)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6776)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6401)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6446)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6685)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6789)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6432)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6432)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6436)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6436)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6721)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6721)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6725)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6725)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 6890)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6890)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6320)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6320)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6392)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6447)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6447)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6452)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6541)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6549)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6620)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6620)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6686)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6841)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6841)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 6844)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wiewa64.elf (PID: 6209)

File: /tmp/wiewa64.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6392)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6452)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6686)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 6844)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6241)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6706)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6319)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6423)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6536)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6715)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6770)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6843)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6879)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6927)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /lib/systemd/systemd-journald (PID: 6295)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6319)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6320)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6392)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6401)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6446)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6447)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6452)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6541)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6549)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6618)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6620)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6681)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6685)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6686)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6740)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6770)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6776)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6789)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6841)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6843)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6844)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6903)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6927)	Queries kernel information via 'uname':

Source: kern.log.290.dr	Binary or memory string: Dec 19 14:10:46 galassia kernel: [ 591.693307] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: kern.log.290.dr	Binary or memory string: Dec 19 14:10:46 galassia kernel: [ 591.693327] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6436)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6725)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6894)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wiewa64.elf, type: SAMPLE
Source: Yara match	File source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wiewa64.elf PID: 6208, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wiewa64.elf, type: SAMPLE
Source: Yara match	File source: 6208.1.0000000000400000.0000000000420000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wiewa64.elf PID: 6208, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
wiewa64.elf	47%	ReversingLabs	Linux.Backdoor.Mirai
wiewa64.elf	100%	Avira	EXP/ELF.Mirai.Z.A
wiewa64.elf	100%	Joe Sandbox ML

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
raw.cardiacpure.ru	178.215.238.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.41.dr, syslog.179.dr, syslog.113.dr, syslog.290.dr, syslog.163.dr, syslog.169.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.25	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.25	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
	Aqua.m68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
178.215.238.25	wkb86.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	wkb86.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	njvwa4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
raw.cardiacpure.ru	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	wkb86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wriww68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	qkehusl.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	wkb86.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Employee Benefits & Bonus Docs 2024.vbs	Get hash	malicious	AsyncRAT, VenomRAT	Browse	45.88.88.7
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	94.154.174.120
	CPNSQusnwC.exe	Get hash	malicious	DCRat	Browse	45.88.91.89
	b3astmode.sh4.elf	Get hash	malicious	Mirai	Browse	147.3.223.242
CANONICAL-ASGB	wkb86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	njvwa4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	m68k.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6749/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6918/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Q:Q
MD5:	046638D8C49B3AEBFDB27A1856E9B89A
SHA1:	847BCBD1DDF9B67CAEB28AB7F629E2D124C12B9B
SHA-256:	B94A208583BCCDD1EF7145D962DFC997327741B1FCE1603FEA6DBD54D34B4E6A
SHA-512:	D6CA70C4CD7D71B5C3BC2052E47234E1F2720B87F9733C9D0653E4051DD06106683294BBC30E01BBC38B3754C619037AFD83B2CE854E9838BCC40E27443FD09C
Malicious:	false
Preview:	6890.

/run/systemd/journal/streams/.#9:1333238DggQQx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.447482377676841
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsM6Gtdv8jZcHcljX+:qgFq6g10+f+MsM6GvimAu
MD5:	9E77504CF5D44AE5DB0BEFDB89674515
SHA1:	BA5BD65D227B57CC8BC05DF5A4A7DAD2F927BAB2
SHA-256:	D00E152974578A97A854299BE61A9BA7A7E7F820D3961F5289C683F7D4A56AAF
SHA-512:	4DC5AF59367BB21696A6392A3311A9A44BD96C34C7F88E38C514A4EF206C9A5C94DE58FBD5BB5E2306F3F4DFED0A09C5910E525900F883BE9F12F08B6B397F3C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=faca93c3a43c4927a6baad9463d324a8.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:1333243vKJcmA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.414917254175652
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5gwUhwvhDx0huqjsc:SbFuFyLVIg1BG+f+Muwlvhd0josQu
MD5:	5A5202E6349D681EC237FB0C97F2E5B1
SHA1:	A5D0E7DC080E3A50545CFF30D3128D64D438FF98
SHA-256:	D6336BA4ADCF5BFA6945BFB46DE80EC8B9D01AD174C0178F4A4135BBAD3E3B10
SHA-512:	CA29B90E160A8362431933E1278EF36CBC0BF5E7913D701055A1728A3F3814BAD7D865773347312E1DB61850751140D34A24EC54991E08CDBB217ABECC634FFD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=33cebe016b7e48308dac56b997f0d516.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:1333247w4YL9A

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.366490421578005
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MBduYH4HXD+cN2jdCLKzK:qgFq6g10+f+MBduq4HX3NcCLAK
MD5:	CCE805E9117A8CF36D2B2189EFEF8A73
SHA1:	7C997DAC7FABF0E1C1D1B5809DE1D84C0A3C3DD2
SHA-256:	E38D36C770F8024134DB6BC61BE2742648CE3ED922F7A4DFE2ED0C408D07F1A4
SHA-512:	3AB1B553B37735D6E57038EC4B75CABFD530313508D88916B6C99BE242586E6D5207461CD8CC28BDB38C16DD71C235996C3D915BBA9E223A53D8BFB4ED9B93F2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9f26080a0f0547eb8ecb59eb23a33909.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:2773000nChlxA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.42914680049211
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+jjCDBSADhQeHM+sd:SbFuFyLVIg1BG+f+M+yNzJsTjosQu
MD5:	FB076C3B25DA4B48A952126E2AF9C891
SHA1:	C013293EC5431E9AACCB7126863C6D66AD64347F
SHA-256:	CDE61F8C7150ADC2137436C59481D549F63AC3B3C46EBA48C4523DD3E9C1424A
SHA-512:	D2B21661356A9767155F506DF58632725936AA7C3251064639E01F01AAB4C86CC3E229687B421FF653B25F785F31412B233F490923DA4AAB78B741AB013894C1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4bff46282c0f4ecb85ef9bc5de927bfb.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:2773002cUL30A

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.408101104424417
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+XLXSwAT+r02lsjst:SbFuFyLVIg1BG+f+M+XeT+0ZjdCLKzK
MD5:	8A43E7996B85959C013D126BF31E021D
SHA1:	FDD99AB20F6B527A2A490B89A9D1666FAFCB71B5
SHA-256:	6BE2CA5448AC4310493C8E017125B3A1F3AE80C1D04B4BE8811FBDE24A43A1E7
SHA-512:	5D6B95DA95181A029E0E5C4433B92EF996F07C1E8A9086D65FF350387A69D5E2E63DD67F5F7ADB79F01217632B1188D116FDC9FE0A4B23439C1A404ABFC18052
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=455bfdac692544ee87b52632060179ec.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:2773088JfGNYA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.310842072785411
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuaACuDEHLdNWVWMRQ:SbFuFyLVIg1BG+f+MuaAuHLdEWM8jtWQ
MD5:	1D654F2D6618087EA6DE9ECA9E241AB5
SHA1:	5DEE8EFCCCBA22E4BC2064EDF1B78DFC595A722C
SHA-256:	88A20AA9BF55B79BFEFB2C2B99B3B5BDAC6E49C461BD4261C9737CF06A1586A0
SHA-512:	33B73FF5DABBC4F8739FFD8AA89A29B743C570D526C8C312C100472AD4398A5A15382B4346DFE1837975D4A7E16742A3AEA4703A25B298B3B30DD48E7B3C218D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d3e9b8e8e551415ab46d86dfa9ed03eb.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:2773090vQIxky

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.455071499939115
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5MrUPS2wqjsjOdlJO:SbFuFyLVIg1BG+f+MnP1FjNE
MD5:	494E6D8C4CE255AC6AE6559EDDA22772
SHA1:	4F5F2A356AB2AFA0F2F55FC90A473DA80C1843F0
SHA-256:	C012005DA16CFE533BEC03D9F1220521D8C10A4D8D0DAB91B54A1712CAC34536
SHA-512:	DA9CA6C95EA14E0C04DB965C10BBBE57641A8A463FB344364A1DBDC4D57593D1471529A148EB191CB2053FCF925D8A675418174524F6549392C302B65579FDA7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3507476f4800411b8ac5137da39d326f.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:27731040dx0hz

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.388027506202487
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+TD3Vd/BbEssZjshP:SbFuFyLVIg1BG+f+M+H3VdVEs8jbVC
MD5:	9B98E4E2F82A0090B2539D22F2CD65F7
SHA1:	98FDE33997D2362F8D83E79CB1D34FD6905F03B2
SHA-256:	CB391E6E78E6B072C9532DF6BA4C4FF7A15575866971FBD71063808FAD17C5C2
SHA-512:	FA31546BFF1D44D4EF6A2D08F9392ACD6059BD11CCB907F50833D080E203171327B0E21997A91B62CAA616C1076AE2DA6DCA4D0A8DEBBD17BD947BDEE2DDFB3C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=41eeea7f7ad3425080c8c00dfb216e37.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:2773105ZIbEDy

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4021149866463585
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyyD3oQBmGxQV0wsj+:SbFuFyLVIg1BG+f+Myu7mGxs0jLkGq
MD5:	0B17A94E6E92045F7480278459375906
SHA1:	B6CB980A161CA668C253A1AF512ED7965835BE01
SHA-256:	F7B8E9A32A4F9FEA8DAA0CE203C8E1E9EA1A3BCC37A0D74F367D4435EA86FA53
SHA-512:	233DA771B988F67526F69104CF1054CCA66B9DD2518031EDDE81D86408A49B0FFFA49AFDF430E6EF975D9F7857921A6E8FEC138CCB598C9B2F0E96609641566A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89e92db8d56c4de087925244ecb45bb0.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:2773106EPLG6w

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.459610755748707
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxms5Gv+RKRxsjs2ALAXaN:SbFuFyLVIg1BAf+Ms532qjNALyAZD
MD5:	46251B4C6FA076EEA08A85339004AC07
SHA1:	E390C3AC4FB10497890FA6E8A50A7AB66D3381E1
SHA-256:	09BDD439513DCD4B191B42C94949E176EECEEED8D40D2CF33A3F3F0CA816D932
SHA-512:	17413172C3CE7C251E34A14B0F417822E9E1C3BC4820F8FE03D50CA52CA2805C2A354A47104D9DC601E83AFBAC1702A68E1DB279419578E70348CB2608CF5D15
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f670d582345b474b8bb1b4d1da915491.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:27731071lWCty

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.382748985586951
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm99RToU19UA2GDQvAJ:SbFuFyLVIg1BG+f+MRTJ19U1Ejoa
MD5:	0F9024720DBB6A0BB1235AE8D0B77D67
SHA1:	1916D37A22E154B1A0008154BA5AD18BDA73B4DE
SHA-256:	FEBB82CB1F54E9AA5973D4FE5E714A99B7B24636A8AC0DE095B8FC4BFD324EE0
SHA-512:	99E6627513AC060BBA4F92A039D8D436584D2A3EBAC00A16947A4EF74BC14A93265DA07AE99023C1DF538B931A6E3FBE856018A99EA79E9B5987E3FB420E21FB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=702477fd67194e71b00f61e2c97c4265.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:2773108zBnQzB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4574115250150665
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm9ciWyGG8dR90usjs2BI:SbFuFyLVIg1BAf+MDWygdvyjNdQIeXD
MD5:	087104DD10C540A3211794712CA3BA58
SHA1:	7C9D8768239F856296727A077D762A9084F86924
SHA-256:	7B61527D2463B904996225F05AA2813E2F231F3733FD903061B81592CF7D76A6
SHA-512:	1F5D31565AD0FC9F4A2FCB59AEB3D0F19122632B601114E3EAAFDA0B79DB486E24BE81A52B7F47233DD7B40951DCF67CC8699E6AC357D0E3AEF4C5F21503517D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7707cd134156456fa43ad857bf77b1bc.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:5206052tEBqnA

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.397433680735963
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmupd/6ZAzU06XYuxsjsa:SbFuFyLVIg1BAf+MupB6iUrX0jNTZD
MD5:	20233F44CA4953C46C07694641C2C552
SHA1:	9567DB4DE240FA9139553E8AD2ABF627E9DDCD2E
SHA-256:	DEA0E2AC8A5B648A999877512832B9D098E23AFA6DD6B4796E93B35AB3CC66E0
SHA-512:	F54F6F1E9C98F74F1F78830132FFD3E2296A7602597C3DDCD6ABA7E210E04CDAEFD8F8A5E126D271C9439CB6312FF54D952AD19179D7307D344DCE4A819387BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d9708a314b4c4f73be3147caadff57b2.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:5253594s8hVBz

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.4275353778199555
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MsX1JZAM7ZjLTTIWTIL:qgFq6g10+f+Mg1r17pEWEL
MD5:	5C509E7B893A6D97E586A9CB9CF29E73
SHA1:	E78F33DF1026590DC63908E9F8296AFB97EC83D0
SHA-256:	DFB0887D99C6AB39380B29DB35D6F000C52C39904A39F9220F48C18B9C6E3576
SHA-512:	C923CE570F50228961E2ED1B79D0C572C05273FF7E58448D6A925994374577BBF6E34FB708DF86C4EC65C59764E39DDA770BD0608B854A4E7DD4FF2CB064C203
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a56b2b7a91d546e69c006f05f759076d.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:5268347FwYb0z

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.433227280668529
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmp15YnS2WWvwsjsz:SbFuFyLVK6g7/+BG+f+M+7ZjNq
MD5:	F937174CA0F68BCB253E8D27A4B55881
SHA1:	B6ACCAEC2AD090EE635CE3F3EA26FB3D83290E93
SHA-256:	B6B5603255F8B8F291B3A3B96294881348F505680680DFE852150987DE9F5887
SHA-512:	B4AF18CAA392D6A18F54D067AA3A2F04A534E25D0245D50CAA07DC241C99188304E4B138A9F37629C96F2BCFC3259DF972CC86DC17A8295289CC8D6891884CF9
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ce5e991788c347ddbc56be0012c41451.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:5268349MrEKCz

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.405817137243163
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmrBjdT/SE2UzX7wb:SbFuFyLVI6g7/+BG+f+MDTn7ZjNq
MD5:	0707FE2F0FDFAFABF5131CFC47873457
SHA1:	FB7E36E955026DCCEC0FC3C07C359289CCFD41C8
SHA-256:	8A706CC96A107CE5E973BDAD765620543FFA6B20DBBA777F19C348292A023B6D
SHA-512:	2A6758F141BD46E05054B4D01BD92EED1A6CBFAA9944F3E7AE6248E7F52E3D5B4C655B33D537829B70AE88C134CA08ED3C082694DD9F5327C0E88F7D90F3F390
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3ca57c26646470f8de7ab317e6ed58a.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:60570972UHEPy

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.376381445413838
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MymID9uSA7PjZcHBrt:qgFq6g10+f+MDQudmBB
MD5:	2C92FC3700F676C8A79A333089F52F35
SHA1:	9E794805D34ADE34261CD0EC97CA6EFB258BA0C4
SHA-256:	EE037AB65772C31D841CFC85DD96096322442256A0861C4E9C782F06614D4C09
SHA-512:	5585EBE2A10C0F7C39A2070C20D1580CCACEB6E5DB3022661A50D1A1E8D285B1C3089A87094D18B86F5A3C1F2017618A94CC4F23DF7A0886384B5C4CB399C4EB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=84e1fffa11f04d308818c4cea1495cc8.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:6127343wjUCZx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.510535932551256
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MaMOJQvqjFQMzKaBu:qgFqo6g7/+0+f+Ma1QATmh
MD5:	8E6FA5478FCF29AB569759A2FCD1471B
SHA1:	F81E903074AB724D6789940BF4816CEADEBD9BF8
SHA-256:	30AA887CC4B846D00C8A9EEB8D5B172F9E7E6C57A9B7AA61351AA96857E6B091
SHA-512:	C838860332E6D297415FDC4060B9D3F18F773C3FB898301B90B266F334D14F558A1F070FDC15710317E3BF74529002063C9428279CF4ABCD97D92E8EAC75781D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=392fd36a565f46d2b89ce384939e822a.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:6131738RTD8yB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.51764908766232
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MtLHGRV2Vv60jFQMzKaBu:qgFqdg7/+0+f+MtzGRUVRTmh
MD5:	C6E46BA98AFC7CD9265FF6B7A9CFBB64
SHA1:	F494454C694C50124262AE7E321BA93FA03A01EC
SHA-256:	04A63680583DE34D0C752D3CA776A9C99A5FE93C8FC758DC8E26F5571EB39BD9
SHA-512:	08B728FD369E1CB83C8E5248353FA249B0BE6DE8DBB168E90913A16F5629F67392413E6E2084113F71DCA733F687ECD8A73C97D54EDB909627495CBD0CFA9B47
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c06053c63fbc404590bc9c7a13b3871d.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:7362381gHD9wz

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.35642519028661
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvhnl3ZuTUdXsjsicz:SbFuFyLVIg1BG+f+MFlZDujZcHjv
MD5:	81F3333EFF8713BD63A7F060D0525C8A
SHA1:	CC24E758A9122D1570082F605ABFC5AAAECF9BD5
SHA-256:	634586EF38A6D63E04D406639B5D245FB2AC2D811AC7AA8D69AC421BBE75BC96
SHA-512:	52302AF6971A96DC48D825BBAA706BF2A01B9CAAA7128B56FE8B97CA29E23155CBBCDD21E02CC6A372D5AB94103A1EEC6B9022E68808742023D810E91EF38169
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eeaf029a150d44b4b58d7b7b265475aa.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:7362428KP3GNx

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.3416945677842405
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm60WEmGcDVJRSgrqjt:SbFuFyLVIg1BG+f+M60WEmLDVfT2jtWQ
MD5:	3B80F72F33349AA160D76285F9D8B863
SHA1:	E36F7B8C64701C356F5396B6C500E77F14E8837C
SHA-256:	0CE6D65AD0D236BB31B8E45CCAF00A15E92AE9A8BEBC3B195D0C48C2E2A0C8FF
SHA-512:	085FCF7223B709B3CE84645E6B8E80B9BDFF7CE925509C1588037501BA34CC0EF97E1D484D8EB000EB04D8988F7F8176D2FDCBC9BC526AB0E06D1B6D2FFBF286
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0e42c7e4a91b4a16935183c9f040a14d.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:754590Iyyra

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.526234063704461
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp6lvRUC/bT+sjs7LH:SbFuFyLVIg1BG+f+McFRUC3Tji4s
MD5:	05F7B7FB011DC881BDF20C6D05CABC55
SHA1:	5180BC062402167C181C167B520591D7999EC52E
SHA-256:	FD740843BE8816ADF0A758E1FFD4D49F7EEBD1CD1E3B615467ACFC29947208F1
SHA-512:	51258D78E1A4B7328EA3D411ACBDF03DAC44D7A3D53339EC380EB794D42C0560F0E186D3509B0C097BB81BB2123F3348798A4DBEF9D302AD8EB289226A53A314
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c9927b9526874c77b2a8edcdc8422c9c.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:75461AwhpOd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.544067751658255
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5ZBHHSGXGDpFlsjsv:SbFuFyLVIg1BG+f+MH7XGDpF2ji4s
MD5:	EC7C57523870CB830BA401CDC24B8195
SHA1:	A74A770DB85153D84849B7DBF97330E94B24C4B0
SHA-256:	C38FE52A81866C42D870D5EF7B21E945424231E78BF6250D3B090B9480707869
SHA-512:	4A480D15262B5F1A05ED87EB97B782D2B751CAED6E4C9113C25A2B21D8FBB01734085A18682C304A16869060433600BEB413D45276B9633676166BA5DB97492E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3dff25119a584a65b69d63ec2bc537fa.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76245XQpXHc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.428552824374167
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy2HQlYkA+grqjs1Ha:SbFuFyLVIg1BG+f+My2H+AejosQu
MD5:	B78D6D8FE951DA86703F8FCBB2218845
SHA1:	06B7EC4E98E1404069C459B0942D1025956D5780
SHA-256:	12C24125B6EBBB73E494B8FA41673B06A5280854BCC057D3553222F119805557
SHA-512:	DA2D4361E620EEE0267A7E6F83F7EF07A08524CF71BD6B2230CD3584F0827B0A39AE65D81B3442124662C3EC0FDA67284EB598971CB0A3B5D67CB56878ED7980
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8b3b5241c603472eb19874e1c5d051e8.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76261t6uCHa

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.419580025399919
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzNRVUWX+aTVTdpxrj:SbFuFyLVIg1BG+f+MfVUWlvwjdCLKzK
MD5:	43D533FB3DD621375297FF9EA9734A2E
SHA1:	1730A00737AD01F3E3E0D8F0F896F95AD2018223
SHA-256:	3852CDF5BDDE5A2FD4607632A34B1BE28B48D5D25B530CC72BA26672337A0C5B
SHA-512:	4DA4A5586EAF48DB5A087DE683B749C7D61E71578EB8920F0BD2D0F4E126287DAFA97B987AB3554A4697D4954D582D4DC611B6CAE1659205CD8324CA414200F0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=96d405d3ce6c4f6f8bcd62f0687b5194.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:76268supiHc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.386063931562411
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5itFRDTBcHApl+sjt:SbFuFyLVIg1BG+f+MYtFRYAplTjtWL0
MD5:	30FCA79E1036E561FBCBE92D4D49D9C5
SHA1:	83238B911FA69364A8AB8A5220F0947F119B03F4
SHA-256:	D58A58D818634E207CD7AC2EECFA09C2239947BAFC0BFEBA5F673B60870F7258
SHA-512:	938E702DAF18F0B039D915939E86F2A1D87A509C51CD167B4B5DE2E863EC344A71B921899760ABA8B4A72490152C30A3476A7B5AAC712BDB0C460DC2BDE79EB3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3eb97cd7f52c4f6d9b8a26d53b415aaa.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76473bu4Hja

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.484661672331764
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz7+DeXDBxoSgrqjsV:SbFuFyLVIg1BG+f+MrTXNg2jZcHcljX+
MD5:	3F7142F2C2F8FB6878780C209975ED3C
SHA1:	2B1128C4CA36856759A7471C6E38C1BDACC88E05
SHA-256:	C098DEA01DC78F571AD253875C5AD686CE107D9F6AE5B7F9A3B1F83486F98B99
SHA-512:	52ED82A77E48FE4FAFA177BD467381B3C7C0145035ED608E7B07EF8533539396F72C1B0EB6604C69E7EEE858CE22DB354982A68EA764ABC2CFE1A6D671B23FFC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=925a6d0153b14f2c900e1bdf6e87c6dd.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:764748cvj9a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.433132263498561
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvlCiDbQUkLnqjsjOA:SbFuFyLVIg1BG+f+M48Q5qjNE
MD5:	4F65D3FDED46667600FB54CE5C839A4B
SHA1:	64640212B376D8E65A783238EAB0900AEB62F70E
SHA-256:	1153AE91DDFF10A26BD34CBFB87DD32B1FB19408E6D11C857D54E37F1E93D8DF
SHA-512:	CB0D1D2D266F051005E53391A35B3D5C21ED14C26D6A5F8495BBA6C8C7C7F80329E60A9961C53F3659C94F8AACFCF8CECF8B764697E0E2E5312DAD707AA880F6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e738e33af5494551abf5c3f174cd1789.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:76592Vio6Jd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.411835235574371
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5wlKFGmdWKvRqjshP:SbFuFyLVIg1BG+f+MeluGjK0jbVC
MD5:	922924B623573CA3371913C17EEAE8AF
SHA1:	44786B1D9A0AC0330310337E115D8EECAA576928
SHA-256:	929E9F268249E080038CCEF89CF2F1DD9038031162A1F9005E5DCDA2A32130F1
SHA-512:	240C72460EDF7ED17774CD3A9C44104834FF020F1CC05959697B880F9B9CCF067C3E61349774F2206201E161A8121D1DEC332B401C002B9BC852AD4B6057AD62
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=370bca8f87d6413caa60bbfa92e83416.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:767906tL26c

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.45822745072274
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/UFVAIDReGSE9zZjs2o:SbFuFyLVIg1BAf+M8vXDrSYjNALyAZD
MD5:	21946D584DCD9E78F01BCE4A14B330E2
SHA1:	AEC335A74806B16E63A09A920D2C17A0D2628BFD
SHA-256:	87ADDD176CC1B191F5F1DEB8CB8A2F5AED802CF1BDCBD60ECEED7B878E44E473
SHA-512:	898705E4B2E4A02E64E7BFD4B2CBA2B4F91339881BEBEE5EBF8498DE6BF601952FBC4471D31838F96328C8726DB07EB40592872E55EF803A2A25BB16B8439981
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5d092118b0e14f77b89c76db520a4059.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76791HwN2Vb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.433025849833237
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9gSp1TXiAKST8jswK:SbFuFyLVIg1BG+f+MySp1tK/jLkGq
MD5:	00D47F6D1D455BD6E4E1E9203A36B45E
SHA1:	3A9693CA8F2CB3ADE4EE717E9681392C1E76810C
SHA-256:	D0DD366C74905DEE00A3DCC252D7778530F38CA0B81076A7E65AF13B55E207F4
SHA-512:	3FEA5FE640109768D3D303EF869C008899ED9FC63B32BBEA2E6DC96224F14EF58A96BFBF086801E2DB6EF8CC8099666D7E9BDBDCC7B1F3C0AB7AB62249B6F88A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=739cf7a153cd4e668644ce96508367bf.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:779484aacmb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.476478290826935
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmrkWdCr5jQQfSvAuqjsd:SbFuFyLVIg1BAf+MgrIqjNdQIeXD
MD5:	672585336567267D379E2193E699BF06
SHA1:	B48F91E77AC3EDA7671A80FE4684C26215C9B794
SHA-256:	5E7355F03C716C40B06E9277C2FEC99B0B71ACCEDC1ED7DB1D6D0096B53A3DBC
SHA-512:	85CF3DE11EF64C0AA70806EC4B1E684E871021B8523DF06A48F8930BECE9F812CDEBDA8FAB6CAC13DA42A8F817331AEBE1D1CD50BF2842D3029CFFBE6D951895
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a5aeeb1364524691876512370e655ff7.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78033bZ204d

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.477630858734977
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrB3zR2ekRGE8jsmNu:SbFuFyLVIg1BG+f+M9yG/jdCt/rRMtq
MD5:	26A73D7D287FE1A95129134A42A66E26
SHA1:	1B690B57FD8A52464D19DFDFC4250F3AC8572C2C
SHA-256:	075D51E9D379412828ADBDC2B07A0D504DACF12A8E254B257743280780C35F2E
SHA-512:	33EC79AF1A670E5560AB0A75199B1D6C7406F3DBD64C17D3F1E2DD73E4200650A867AA4B837872A9870A3E714E8D4ED4EDE9D9E759635494E8DE7EF92403F79F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a3cdde34cd974483b92b46868b5af196.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78175OmREje

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.401728921802665
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoE0Q9I6QjiB0svsjs2R:SbFuFyLVIg1BAf+Mo/Q99Iid0jNTZD
MD5:	9AD007D9DCDEE6C3E8D94B6AF0E10CA6
SHA1:	C47C3D3F4809C714C8262CE5912008308EA8293A
SHA-256:	8D6E7C11DCBF0259D265AED26324DCDC88ECBB62DBB3053E70E55BD64F2E92B6
SHA-512:	D1A8A8BE806959E4D616164A13539666869D60653E182B4EB78FDD108C623E467437793B96EA26F8AD264BBCDAA8F40FA197A107F287A6FD04687F5A0AE3FF11
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bae452a40af1449591c89d84b3d4737c.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78281VGLXjb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.425673003442173
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6VEnR1ETR8zsZjswq:SbFuFyLVIg1BG+f+M6bKsZjLTTIWTIL
MD5:	A28A6809AAF28467C3788006C9CB7C0F
SHA1:	66C2B4137B51601CEB5E91CB7E6970C7FFB80D3F
SHA-256:	BD2C8C2C27AC19F415F455934F0C75F352481B883ED408AE80220379D2FB1697
SHA-512:	34B163D6B1FB36E66E3977E10C18ADBB4FAB9F6FD693CD017F7FE98E3B19975CEAC5A85ED16EAFD3F7B5EEFE2AF4A2D04D5C69801E35CEC20C771601FE4DA1FA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=05e0382f0b044b8da626b1072b4c30ef.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78312pBZgbe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.385909171661216
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4FQB0KwvAjV0hTjst:SbFuFyLVIg1BG+f+M4ZKcAjV0jdCLKzK
MD5:	F4F49E4BB8D4C0C901B2C898C70F595C
SHA1:	3F82D47C7C988EC088E92AB0954E8B850891FDE1
SHA-256:	CC6856F79091FDC71204B531310F80926FB58362E5ECF5E95E9A65B00B07E01C
SHA-512:	6CF0506DFD8E1ACEFB52929913E48CE0CBCB2BB7B9167A99C2F5CFAA95674F55E8D5A020E62B4C09ACCE830A9F07A735A7B467209D18EF8B72109777B0B626AE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=26a965d7b6c44e79a28ae97f45a020c7.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78336mWtnQd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3810074889273025
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm54WX5G33Xnoglsjst:SbFuFyLVIg1BG+f+MaWXYnXkjdCLKzK
MD5:	6DA0CAB373103355EDD547D48A687522
SHA1:	AC31ADBFE7814EB410A4E4EB7581F5EA9700AAEA
SHA-256:	7F2559389AC9AB21230021D207E5D35D01E854D5B647C03CC9372154B3246596
SHA-512:	AC079BD1889CD95A02E5DC7BAE7852B7D041E54470954A113FD08814CD80791C5A1154D2C3C4E65C87DC6D6C0B78E91460C1B0C19EE378FB4A267027CFD48A93
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3a4f72cd9aaf46418adc942ac9fb2932.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:784442DV0hd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.414323278057709
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm9pGRU7Rdo1AZA20Zd:SbFuFyLVIg1BG+f+MnVRy19zjosQu
MD5:	D9C20ED14C55F06A70944BF8AEA1D1AC
SHA1:	CC2A779D8C6092F2BBFE35FD43E77317BA4D23DC
SHA-256:	90FB45B58581780D7A7D35957253DCA7ADD0A2834A0DA0451FBCD56DF7DADAD5
SHA-512:	D65C60DDD63D96193162CDA305A18194C60CF383C49DCD785603D8C4A1629ACAD2B16E905C391BFD56A81178D7F3487F3E78993C28EF5855458598B8DC38B3ED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=7d4ae56e7241482f82aaa22dfe603b09.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78479LtZqGd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.496158604208948
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MeHdsyPERqjZcHcljX+:qgFq6g10+f+MXyPCkmAu
MD5:	66BF67713206B4B0C65F62D1FFB73324
SHA1:	E62E8C78EAEA89025EC66ABCF74D7E58D2C8AD32
SHA-256:	053659D7AEA7B2083CAB910D89D8B4CBBC812C18143FEFD81211EE574DA1CE2A
SHA-512:	9E9F1F9D583D0C333C76A8F5E0495B6E4360FF9536D8F2DC4C511FF57ADAF4DF578BF84E9FAE5EF40BD07B3B984FA722E4C675E0970E21CFA8722AC1137E4DF4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c56d873fecce4242898c7697d9638167.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78497MVMW7c

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.4178274870508805
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmy3oHyRIR2PGHnDzR/:SbFuFyLVIg1BG+f+My4YHPQH8jLkGq
MD5:	94270AAD792B8D25359C8CBABA2DAFC4
SHA1:	ADC5F182C5259D6BB72A8C763F74B62BDDF08924
SHA-256:	9918E7C9012F20AFBD093F6C1A70475BF0BF936153B53AFDEBCAF0055B31483F
SHA-512:	05EFE22F7F34123924F8005A42245FD2B923758FDAF84D30F82B58E645E454D9264E8DE97B06E39C1E0EC4555A6A5523559185CD5A1BB5C064B5E0E387256FD0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=87aad994257f450686a2de613cbaa0ff.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:78575pzqrMd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4140169149363375
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MeE4pXAFrqjNALyAZD:qgFq6g1af+MKpwRwIZD
MD5:	FFDE0BA4D7B494DA6A642BF826614908
SHA1:	E153DB21D237C6235B39A115B5BB8181DA8FE4D6
SHA-256:	5212E5DBBA0C21490303DD6F95DFE8674D3AA084E39117AD7A65A3C5AE9016AF
SHA-512:	6B472A27E3F369F6469321F4650A5307B6E1F0250775D5AA2FEE2CDD897B9002536C6AF4D7E47BF9D336CA5690601786D017B576297D7DF7536EF586A04529BF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3b006335bbd64301ae8e6df50f23dcf7.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78649jqtNQd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.4688496629860035
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5bNQ/FKtGXrqjs2BbQL:SbFuFyLVIg1BAf+MhNfG7qjNdQIeXD
MD5:	151F4C8706ACAD1F2F29602D61B610D7
SHA1:	70AB89FDED6DB3C6582DC945B446C91AF0F89D35
SHA-256:	2337C9699661EFFD4BEDC98D85B05AEF1EE36EEA677633514C07EE62472C1DDA
SHA-512:	A663922B7C0FA804582F472E400103778F3D105879CAA29AA280159CFD8ED2B975F09426795884712DCACE54A9E0CCFDF45370683D03D3ECAAC37333C0B975B7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=30738d4597ca4422b0a94efec28c5c5e.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:7873829BcOc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.351681212628697
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MDED/F9b1GYTjdCLKzK:qgFq6g10+f+Mw7F9b1GmCLAK
MD5:	CDF53DA16141ABE7F1048AABA5533F51
SHA1:	DAA10CA05B4C9D122AAFB79A557AB12D831074B9
SHA-256:	C3260345A67DDDC9920285A44BD3CED5649206D39073979C89D53C25A5D179F2
SHA-512:	404A33256BF78BAE47F207578C55947E72F1650F52D7BA7447060D4EC86E8C98839244D0DA126A591AC5FDDD8D06999E45C8C32275B1557FF00FD9AD7E2EF150
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eeeac0468cf046658f9f5560f39b093c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78771xRTHuc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.436811307198066
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/NBWWBDUdGWvT2dGD:SbFuFyLVIg1BG+f+MWnVicT9g2josQu
MD5:	39D382E7D5814B7C246DCFB66FC13215
SHA1:	AAC89CD23A42A9693E0768F47CB7DA5845093325
SHA-256:	CE412F8A76E83878919FD0674E61D06DD32D3B13930AE7DC76BFB583C882065B
SHA-512:	328A8F8A66659885353208569F453AB86302722C3E8F09263C8435AD8F735F4FE50D19CB432DDCBE1E4338E1C70C1340157AA7AB9CA3E871F37DDB29E3138A6B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=511c32c3df164c3796098fe11a760f63.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:79884rqdZ8a

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.363284323743445
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MqT1X9G3EaTjdCLKzK:qgFq6g10+f+M+NKEaVCLAK
MD5:	7A1CBA779B74DE0AEBC2E87946AFDFFD
SHA1:	5959FA49454B93F310ADF098D2B406556D380147
SHA-256:	EFB96985AB3A43B68581ED479146802FBCE32B93CF6DD534DCE74AEAE2D445D1
SHA-512:	28FC4F724D23A2D572196AD5731C93A29229FC4D37D823124EFE8CF4B210638F881B50724BC5369D0AEFAD260B52A226377286E286618B4C61D4BADFCB7DD8BD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=eeb67c8e14fa46a2966c5002e1c71806.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80654SHY9mn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.511694294488417
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyjabgWlp5xsjs7Lbr:SbFuFyLVIg1BG+f+My7i0ji4s
MD5:	D481603014C801895492CDC1A27EA3D0
SHA1:	8A15E16A3C11AC6E4396E4140BE042D765D1E815
SHA-256:	670AE5B8BA3739BDF26C98931DB890D69CF5776F439C447E65C01519C130CAD0
SHA-512:	E8E6FB9CEDA83446488E929CAB4ABADC029BE6AC1E4681A63E74447839B1E6116843AEC6AFC14365F70DB67991CF8D7C34F1B1BFA1C309312B5EA35AC8D86C51
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8d008aea819943fbb2d74ada51bd2f3b.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80732YNEZ6l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.511480465649446
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpPPRER4dByU4jsicN:SbFuFyLVIg1BG+f+Mhp4djZcHcljX+
MD5:	3BC61CFF6F5AFB688650E0DD243709AB
SHA1:	D57FA4200E1B245A52D8435F6CD4CC59A7428B37
SHA-256:	FE90D0CEF92722476375C47D10EB4542365FD0280EE0E83C09BA737588F6541D
SHA-512:	6032DB4763CD58A65D028222FDE6B988B93DA8EFF755C23DF5E2CB1FD9818FBCD3AFF8B2FADDE71CB33C6294B075BFD135442D37FAE3E43FE9F61BD3FC637011
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=cd60b7c9b8144a4e88d213633659fd79.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80733uCXTAp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392331650570207
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmz+WDSEdU8HcTiW4hm:SbFuFyLVIg1BG+f+MiCWWs4ZjdCLKzK
MD5:	4FDCE4E07BBFC2A77F2C75552ED155D7
SHA1:	1C3AC04125865237E7628A19BCC18D596FF07EF6
SHA-256:	CB8F97FC55B242E0EC8062693F6891030201CA7013E036C8FD09917CF40409C0
SHA-512:	84A44011624542AF6428CAAE94413ECD88D1ACF0620BFE0B77A496BCEF803AAB0A619D5B15583D9F0EBF07A893733A15C7B321C3E75E702FF5F64D6A434D3A1F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9ef9d294e26f4953a813f0b965b4313f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:8073409beim

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.42146876011385
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuXu1hxlvAg2josQu:qgFq6g10+f+M8u1NADQu
MD5:	2AD0EF18B980D388EB841C69BA59B03A
SHA1:	486DA6696DE8D4E440276B3D72035CC16064E8E3
SHA-256:	00FC001D10DBB531009196F365E4C5ACA6BA9CE55158B638353D69F64760782B
SHA-512:	03BDB7D292D744989250D8B74416538D3713DBF5D0A0A7F8E32CD4A8B8B824DE2A7CE21021D88FCF0E6CF73E7B625D41D350BE3D4685B5A45802489F13325CC7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da7693af5a8f4a9f9af7eca16c21e204.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80740oAelVm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.392298429050365
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6wza7QHhesZjswkCM:SbFuFyLVIg1BG+f+M6wGWhzZjLkGq
MD5:	1B35D16F4EAEA755A9D0DF4A436CEFA2
SHA1:	60A9AAD54B8D4BB83EB8F10C736826762C99AAB8
SHA-256:	DC205CFE4F5C93CE9F9E2FD780806DBAD69D5E78DC635D73CD28D5BE6FAC453A
SHA-512:	DDC151108380E71D049EE3EEC6B2BDF371A8A5F22101C3EF61BA16842057111B0FFC9F85F6925B26F0803B501B61E743113B933E7152100BF24812B0B0E7F9D5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0e0bac3f8cf843ecb41fbb67e270b9b9.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80748ECIc0l

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.38887383683312
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsU7sVUUWvTIbQFlsjsx:SbFuFyLVIg1BAf+MsUAyvTL2jNALyAZD
MD5:	39B49E38D76ED77E4AD93D170EFC8503
SHA1:	BC9DBAC09090E20056A6A7F11C1D3D073EDCEFCC
SHA-256:	B20CE5E722EFC893AA2726C8568C36D88FD78AFDFAD0295756FD17FBC439BCBD
SHA-512:	ED2106682D15A7915AE638E7D8EF15FEAAD507E28E86CD79821CA9442C91FEDA660B909E077EFED40C44EB5B9B321CE434F5E76C7A534A51F8C18024972763DB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f5df6fa60601444da34d68e946f16201.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80749v8T40p

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.484900951838671
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyfeJDDFdV8Stjs2BbQL:SbFuFyLVIg1BAf+MyfexFdVBjNdQIeXD
MD5:	4B75F2556AF56660285995723BED5379
SHA1:	7D2CAE7F8A61D89315248AB18036F2B89FB17267
SHA-256:	B518BB60CB7074B7E252E746840BD8800679F50F5D65DCA665C370DE358370C1
SHA-512:	5D7C43E0633FF20379B2D2DE8EDE622F297A9027238235EA99CA1182A3308AE00E69F67A35357A931E2EC97E89D98C2A17B6446156A968AB74F67CC72476656C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=836cd03d13594dff934b68053e484729.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80830agTWtm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.412281009592162
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpfgGc3RbBqA1VDi+sjr:SbFuFyLVIg1BAf+MFA3ZBqAfujNTZD
MD5:	E71FC83C4670FC6B95B5CC9199EBC19D
SHA1:	1C9A4BE730D21F95E679C6D0F435EBDDFB4D5BD9
SHA-256:	606F024A400EE08008AB30DFEF115089C70B6870C6C8EFEB3D853C612FF7A0F0
SHA-512:	FA3469646F22DAE32388A5D9B2C255695BA27412ECD74F8604EC7FF0145A4A51E60612AF40AC94AFB5F374B04C32C72B6458FB82A9AE2AEE97B18D78EDCA9F9F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c3b8776c985a44879df11aee50f53b1a.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80933hXRNOo

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.460432377765812
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MMW+qGhkTjLTTIWTIL:qgFq6g10+f+MMqiYEWEL
MD5:	8F4A1CC96D88C6DE0F5C320262F2E045
SHA1:	A2DB60D75A4C3D81813F2E64DBB22010FD5D92F8
SHA-256:	F1511C50941366F47B32D8B140A4E1556D91ECF735600236C37CEE94D9117E22
SHA-512:	175AA0ACD81F978A73F5351B71E8D872F18928F6D43A83DF6B194746C591ED96175896AA536B991C1F37C24BD0F6021053469A619E8ADC1A87A2A6A08A559B31
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a253014e84b546a1b941688c56007f3f.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81038gcyHWl

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.424095296949869
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuJefAkRyEN0MqjshP:SbFuFyLVIg1BG+f+MuJQFRNN0jbVC
MD5:	107DC3A18450F758A68BC8E051FDE3A5
SHA1:	B2C38D711F6823369725A9A2A8CB1C33D1141DCC
SHA-256:	2FDA335DA2A7F687E0486083DCCE240EA573231CF4CD92FD16E36B0F43574FF9
SHA-512:	EF2AF98B916BB4C8B911E2BA92E3CC05112D6778EDAE9E5201F683A3DBC32B4BAABBF045023381217FC3213BAE16B1E477B03EBEAF6ED7F4E9BD3753E4DE562E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=de6fe6769a884be28159d63786da54f4.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:81085crO5Pm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.403815293522326
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6htfRX8zAH60Zjk:SbFuFyLVK6g7/+BG+f+M6kajNq
MD5:	DF4366AE950147BE67A0B4C655267CD0
SHA1:	C17A662700762E9E46D8FA388825C8BBF8E6919E
SHA-256:	7BAC26D40F94B066FEC742DF39032B99A8F0E658FE1CEAAC15352F2FE7E40EE1
SHA-512:	7290FC8C7A20BC99BAA7DD450B171CC8C373C987BCA70B7CDC4EECC66335B890D8A55F87FAF0E5DF02B85197410E9CB535545B6D5D3766055C6B1611DA8206BA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0ea501feca90424c840c7eb23fa169e4.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:81087HXNwVp

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.408345183183325
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmz3UEHYcXTPS0Zjk:SbFuFyLVI6g7/+BG+f+MdbvjNq
MD5:	61FACC6C0BCB979E8BFEFB64DD52CDE9
SHA1:	CD1D5D2D86719E04F5CB7E6CF881DC2B9BED842D
SHA-256:	E3786E30940BFC965F3BFA43F2D0C31D055059345F03F48BA92CA5EAA107311F
SHA-512:	036F52366428D4261163BC039FDAD960BF81BF4185DEDAA859AB9F57AB57C7389FFEC85C04249114457B4973C6F89A71DD8DED7133D206AB867D6283CD103534
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=917f61956a7742c7aaa08fe2ca23cf07.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:8112764JG7m

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.550290768482668
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M6oOXRYhTjFQMzKaBu:qgFqo6g7/+0+f+M6GvTmh
MD5:	0AF189DE0ECDED1CF49DB8CD167057F9
SHA1:	C19883A3933A31741778E243ED4BC6103B2F5070
SHA-256:	5BDEB7D05D196A0DF836603A1FD2733C31EBFF88338EBCE4E48DCB1048D17729
SHA-512:	B3893CD2D78436AC2F31A029AF97D3D3AAA8F0F6E595B214CBA45D8B04FF9704C567D6C25C5133062DE8849EB108EE7C8B85B8E9610797908F53561DACEB488B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=045f15e759d84876ac28694562df8eb3.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:81129gXIjAm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.476447763522343
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MaEVvsZjFQMzKaBu:qgFqdg7/+0+f+Ml2Tmh
MD5:	ED505A713C55AC24A27A699E5C4C1DD2
SHA1:	C4C00D1F3B0A77BFB520DE81E95780326697416C
SHA-256:	F9EEE67156D7F0229C99A22FEA673932FE56AFC2AFC61A10B9EE54A3142E303F
SHA-512:	7054AB127D0390E2A6CA188B049AB59A6D5BA7A99F25A14CB610BCA0B3C3AE68ED37770E09BD63EB37D6B8D293956B8783F4B287F7AEB826A41E2822293D5484
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5e74abe9af2f4535b21124a4e7535d50.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:812314nul9p

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.388671818807925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzz0VccEOnGjTjs1Ha:SbFuFyLVIg1BG+f+MhjTjoa
MD5:	A9492C40748C5E7B7692925392943B9E
SHA1:	4658AF7B4EA1386457D8A033BE1C6026A12C325A
SHA-256:	C453C0FEDE24F3EF281121A927717917BEBA64C649FA9B4AB53B09D74FC1FA64
SHA-512:	9FC1C6C218B63C4821FA20546A0082A07449CCDEA398448061F8ADCDEBCF35C09AF001ABEDBB79ECF0C284468F640B5B354A8D950096EFDA3B06BA7B183EA791
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9129a80935124654a789dc171f1c5117.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:81280PKTxKm

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.368048921201174
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7VlW6GRymfQcos2lm:SbFuFyLVIg1BG+f+MHWjI6Jo8jtWL0
MD5:	493ECBC7BE4C6E099288872D148F1318
SHA1:	CD84471B7D2820068E58A5D06CDA41DB27FDDCC0
SHA-256:	F150D2283E2449742652C86208D1C6E9CAF6FAF428D3419A6ED848D4DBF16C90
SHA-512:	81A4CDC7EA80B6C3CDEBB9AB6F8F58F910FD3E8609CB99DDDC5BC999ADF02FDE4F08972FA32989BA20384575566758EA8452986C3E2B1995F73CAC15344A3E11
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=182913df6a8a497583db1173661c8793.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:81294OmNwrn

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4374776616993925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4GtBVWVQny422jsjF:SbFuFyLVIg1BG+f+M4RAy4ZjNE
MD5:	60E76E81B1B84A3C5FD8BBD40D9F98AD
SHA1:	2DADA0963769F9B58BF5F74179C71AD019D156C2
SHA-256:	4E4DA19E6F2F1ECE9AF32BEB3C94C85216BE77589525BAE442DDC6B82E87EF44
SHA-512:	9EACC83AC71088814CF0BA3D8B7C0E54185E62BF928A46007253059AC2CD550ECA46910A114336266034798F9BCBA15FDD1B3D1FE8A791D95B75DD7C7F989B7F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2c0bd035cc394a4d8fdd9354211577a7.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/seats/.#seat00V1agH

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat01toe70

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0D0r3YO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Iwj9bO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0UMzX2X

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0rLyPjO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1273ri4h1

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1278vPBq0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.315970331346645
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgBaehdTWXmQK41ZtiW6H206qoT:SbFuFyL3BVgdL87iesnAiRJgBa4TWXmC
MD5:	805F9051BF500C926859735413AAFC92
SHA1:	09392633B0F01F6F8E32F00B90F3DDD52F3B365A
SHA-256:	9EF2C918C7D7F34578D047D9AC5BBA528FD1D76B39DB8960074F682E848AF076
SHA-512:	1E3A9FDAAF172ABCA8315C1C0C51D2AC25474EC3D0C79EA8019DAB433FEF13649DB92064F3B1667A978D5824DB81D5F7679271C73479BC159EBF3A05909F49ED
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1734638977863354.MONOTONIC=523105553.LAST_SESSION_TIMESTAMP=523187612.

/run/systemd/users/.#127B7gjlO

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Cj4lX0

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4794273402001
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff47gBa4TWXmf5t67Lv:qgFq30dABibBA7ggYIf
MD5:	44E4AAAACAD5B5EDE52CA4C034434513
SHA1:	2A2C6479E57D3CD82FE86DD3F321F77BF7B6CF28
SHA-256:	179D6C82352291E00D9CAA9310D1255FB225CA6C8C5A4D20833E83302F5CE55A
SHA-512:	BECE6D193C8C5CE9C9F12262DB8612FFA94D38E582851C073B9CC1DEE3F84386C67AD9FAA37D936B35403436A65C1DDDEFCFF6D025DD5D9708E8EB12828E7564
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13948.REALTIME=1734638977863354.MONOTONIC=523105553.LAST_SESSION_TIMESTAMP=523187612.

/run/systemd/users/.#127PhId2L

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.31772819247704
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8dgBa81ZQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEdgLthQHtPYq9M
MD5:	BAFCD4CBD19D00D39C3DC865050874E1
SHA1:	9252390E05068C8AE20EA9FB5AC5A358F76DFD96
SHA-256:	FDF58CC3F55392DF3122248C54E18DE9EED3616A02C982DB75FA42B8D2FA9FC4
SHA-512:	30AA09829C8A2E6196E80B033E707AA14F54E41ADBEAA2707A115235006FE6A2177317AE4DAA0C82CA0EECBC6C23EEBF451688EB33BA06876BA0B4CE11E85A82
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14862.REALTIME=1734639041025343.MONOTONIC=586267543.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127PocM4Z

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.310487610987798
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff3pJgBa4TWXmlQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBTggWthQHtPYq9M
MD5:	24A07DA8E7928AA05C71D6511CB2B082
SHA1:	8163FA979D45F9635A1D409FA3B9553EC85DDE37
SHA-256:	3ADD458297FBF30F9501D520F96EAFD1A7750BCAE780230589134A06881DB6E4
SHA-512:	65A8A391117C9C48663981BFCDBC052CD0C5F725C0D278D2E66F9ED42DE3460E9EC26815E57FBEC62C62FC51F91759BEAD0F5C00514F916D5DB8AAE753C82839
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13886.REALTIME=1734638977863354.MONOTONIC=523105553.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127TY4z0Y

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.310487610987798
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff3pJgBa4TWXmlQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBTggWthQHtPYq9M
MD5:	24A07DA8E7928AA05C71D6511CB2B082
SHA1:	8163FA979D45F9635A1D409FA3B9553EC85DDE37
SHA-256:	3ADD458297FBF30F9501D520F96EAFD1A7750BCAE780230589134A06881DB6E4
SHA-512:	65A8A391117C9C48663981BFCDBC052CD0C5F725C0D278D2E66F9ED42DE3460E9EC26815E57FBEC62C62FC51F91759BEAD0F5C00514F916D5DB8AAE753C82839
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13886.REALTIME=1734638977863354.MONOTONIC=523105553.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127XZRt2O

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.31772819247704
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8dgBa81ZQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEdgLthQHtPYq9M
MD5:	BAFCD4CBD19D00D39C3DC865050874E1
SHA1:	9252390E05068C8AE20EA9FB5AC5A358F76DFD96
SHA-256:	FDF58CC3F55392DF3122248C54E18DE9EED3616A02C982DB75FA42B8D2FA9FC4
SHA-512:	30AA09829C8A2E6196E80B033E707AA14F54E41ADBEAA2707A115235006FE6A2177317AE4DAA0C82CA0EECBC6C23EEBF451688EB33BA06876BA0B4CE11E85A82
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14862.REALTIME=1734639041025343.MONOTONIC=586267543.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Yo07ON

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.499302692242835
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8wRJgBa8175t6+Hvn:qgFq30dABibBEwzgrI+Pn
MD5:	EE149E810C1B484240672BDBF484D1EB
SHA1:	19AB0143A73F679AB397A53282510428D94372C6
SHA-256:	1BBEE7299469BAC8FEA6BDBFEBA11CB21258350C31852D89E2C8DA1A81724302
SHA-512:	4AB8BE16B61B521D2985740BC66377DEAFFFE30633BD8433535320D51D1C8945F67F0F9BB993BEE1979DC259C5BF21AFAC0A12DEFF666786B2A064405922D3CD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14984.REALTIME=1734639041025343.MONOTONIC=586267543.LAST_SESSION_TIMESTAMP=586382857.

/run/systemd/users/.#127c4nhwY

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.4794273402001
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff47gBa4TWXmf5t67Lv:qgFq30dABibBA7ggYIf
MD5:	44E4AAAACAD5B5EDE52CA4C034434513
SHA1:	2A2C6479E57D3CD82FE86DD3F321F77BF7B6CF28
SHA-256:	179D6C82352291E00D9CAA9310D1255FB225CA6C8C5A4D20833E83302F5CE55A
SHA-512:	BECE6D193C8C5CE9C9F12262DB8612FFA94D38E582851C073B9CC1DEE3F84386C67AD9FAA37D936B35403436A65C1DDDEFCFF6D025DD5D9708E8EB12828E7564
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13948.REALTIME=1734638977863354.MONOTONIC=523105553.LAST_SESSION_TIMESTAMP=523187612.

/run/systemd/users/.#127mq20NL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.339050862559309
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgBa5V45/3jaK28H206qodjWNHv:SbFuFyL3BVgdL87iesnAiRJgBa8175th
MD5:	74AE2918AFCBAC321F0FB05A20AC46F1
SHA1:	6942DA7F5305B89E90214B6D830F79DB8FE4A399
SHA-256:	BFF62B85074B90E0B798F106271E7F8923691409CC6E72B83DFF411C85F0FAA3
SHA-512:	0D7FFA0937896BAE0C7B8D91A59EF97542DE82E4746525259E8CBE5576085C3F974A426E1C89BC4F707697704C1DB1BA1715F26A8BB81694220180FE5FB1863D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1734639041025343.MONOTONIC=586267543.LAST_SESSION_TIMESTAMP=586382857.

/run/systemd/users/.#127nOjECL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.499302692242835
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8wRJgBa8175t6+Hvn:qgFq30dABibBEwzgrI+Pn
MD5:	EE149E810C1B484240672BDBF484D1EB
SHA1:	19AB0143A73F679AB397A53282510428D94372C6
SHA-256:	1BBEE7299469BAC8FEA6BDBFEBA11CB21258350C31852D89E2C8DA1A81724302
SHA-512:	4AB8BE16B61B521D2985740BC66377DEAFFFE30633BD8433535320D51D1C8945F67F0F9BB993BEE1979DC259C5BF21AFAC0A12DEFF666786B2A064405922D3CD
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14984.REALTIME=1734639041025343.MONOTONIC=586267543.LAST_SESSION_TIMESTAMP=586382857.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mv:mv
MD5:	D57C658E25F5766E2DAA70B80E998D3E
SHA1:	822EDFF21BD62ACAC29A91258E1A11F43C6495D5
SHA-256:	7DF7954E17FDC9CD13048749CD5EAB6ED906617FD3DE8AC6C9A16B1CB118BF82
SHA-512:	DDF2250C8BAC8A13B2DCCDEB9B8A330E1CCE201BBB7088A864176A6C64A0B36A15609C4BC545F86DD80982E14792503D70974AAE84A5CF3B48A9D977001F1719
Malicious:	false
Preview:	6843.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Cc:Cc
MD5:	668664015543DD147F3881D294C7C80D
SHA1:	05F4A6B24B04C820197172AD2E7AADC9C5F54ECC
SHA-256:	E6898B737077D54913BBDAAFADF7FB9F3AD37116AC1C391C22BF7C5645BD555B
SHA-512:	323216294F29C9F2315F8CCB5BE6FF48603A9775BA96CB02DCCA3E24D0B1F653B84D522B9BC8278F25D93073DB9C15A08B2FFC3DBBFC1FC3E6AF65DA5286F2F3
Malicious:	false
Preview:	6927.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818554
Encrypted:	false
SSDEEP:	3:gSsXlXEWtl/Dl/:gv+ylr
MD5:	D3034D0F71CCA0E981426C5416163F19
SHA1:	684AFAEF84E9A1AD381051BD1815F5FA86A0703E
SHA-256:	78A8F4B46FE7EBBA6C0FDCB2B64EC956FAA18C0B43D51797417C9B127190B53B
SHA-512:	52E756618AC16BCCF22E8A0D1103CDA28F4302B5EA35D82B358C82A70E4ED63C1A3C6F792D3096A18B777B13FAB3CFEA8202EE0F9DC85C1AB3763AF55C8796B0
Malicious:	false
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................}dgDQ......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Cj:Cj
MD5:	4F2D5D9A77A5D5E06C05C5AA3463B25E
SHA1:	E801A26ABEB44F9698849C1478A96B8F92144A74
SHA-256:	B4D77D0F43ABEC6113610C81E3F81CEDD153E55F231CF9BC1ED473BCE37EADE4
SHA-512:	E2B34F397FF0032ACE577548BF79E41B24B2DC53850B106C47D3383DF7D4C342EAE3F2640F11D504BD7ABB0FA641215D97E758A4F6BFEEE0D53140D94DBD65B4
Malicious:	false
Preview:	6926.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:AeQUVv:Adu
MD5:	F64EE6A5691E2D5F1A6566D0A6A4DD3B
SHA1:	1FE350806CE153C7B6E510178B2D89E0BC784212
SHA-256:	49DAEE78D366F98A665A5F37932AE37AB2CD690C29C0E43F98A39DAC040D8521
SHA-512:	F60FF98EB761036E7AAE96D33A79A0E947C7244D2B1260D5A4A5E21EAC14B64F27BDBC81258F17978F24ECAA3AE16AAAC8A26E418BBAF9DE28212EFA19E00636
Malicious:	false
Preview:	6909.6910.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Cc:Cc
MD5:	668664015543DD147F3881D294C7C80D
SHA1:	05F4A6B24B04C820197172AD2E7AADC9C5F54ECC
SHA-256:	E6898B737077D54913BBDAAFADF7FB9F3AD37116AC1C391C22BF7C5645BD555B
SHA-512:	323216294F29C9F2315F8CCB5BE6FF48603A9775BA96CB02DCCA3E24D0B1F653B84D522B9BC8278F25D93073DB9C15A08B2FFC3DBBFC1FC3E6AF65DA5286F2F3
Malicious:	false
Preview:	6927.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:Cj:Cj
MD5:	4F2D5D9A77A5D5E06C05C5AA3463B25E
SHA1:	E801A26ABEB44F9698849C1478A96B8F92144A74
SHA-256:	B4D77D0F43ABEC6113610C81E3F81CEDD153E55F231CF9BC1ED473BCE37EADE4
SHA-512:	E2B34F397FF0032ACE577548BF79E41B24B2DC53850B106C47D3383DF7D4C342EAE3F2640F11D504BD7ABB0FA641215D97E758A4F6BFEEE0D53140D94DBD65B4
Malicious:	false
Preview:	6926.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:AeQUVv:Adu
MD5:	F64EE6A5691E2D5F1A6566D0A6A4DD3B
SHA1:	1FE350806CE153C7B6E510178B2D89E0BC784212
SHA-256:	49DAEE78D366F98A665A5F37932AE37AB2CD690C29C0E43F98A39DAC040D8521
SHA-512:	F60FF98EB761036E7AAE96D33A79A0E947C7244D2B1260D5A4A5E21EAC14B64F27BDBC81258F17978F24ECAA3AE16AAAC8A26E418BBAF9DE28212EFA19E00636
Malicious:	false
Preview:	6909.6910.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Cc:Cc
MD5:	668664015543DD147F3881D294C7C80D
SHA1:	05F4A6B24B04C820197172AD2E7AADC9C5F54ECC
SHA-256:	E6898B737077D54913BBDAAFADF7FB9F3AD37116AC1C391C22BF7C5645BD555B
SHA-512:	323216294F29C9F2315F8CCB5BE6FF48603A9775BA96CB02DCCA3E24D0B1F653B84D522B9BC8278F25D93073DB9C15A08B2FFC3DBBFC1FC3E6AF65DA5286F2F3
Malicious:	false
Preview:	6927.

/var/lib/AccountsService/users/gdm.0VR6Y2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.YCYCZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/gdm3/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:v:v
MD5:	68B329DA9893E34099C7D8AD5CB9C940
SHA1:	ADC83B19E793491B1C6EA0FD8B46CD9F32E592FC
SHA-256:	01BA4719C80B6FE911B091A7C05124B64EEECE964E09C058EF8F9805DACA546B
SHA-512:	BE688838CA8686E5C90689BF2AB585CEF1137C999B48C70B92F67A5C34DC15697B5D11C982ED6D71BE1E1E7F7B4E0733884AA97C3F7A339A8ED03577CF74BE09
Malicious:	false
Preview:	.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.907848513456226
Encrypted:	false
SSDEEP:	24:3CV7Zea7CVxG7CVdLCV2uCVSAvjCVSA2+VBCVHgk70pYroJrtrCQU:3Wr0SevjefVBJYrOrtrCn
MD5:	412BAD19F7B57F5C0A9618F157039701
SHA1:	DB7FC0010909718804B7A6284D5B12BE2793CBB0
SHA-256:	92EE4CCAE9717AC69748A6D0209F749DD2CDA402F80209CCE7DFD620BE57334C
SHA-512:	4BA6B2B4C0DEFF92C8C29B0F9BEB8F3A7A2194C5449417C7F1D2B94E5686A61D3C716C4DA66A7CD8437FB30230926D9026B1B4769B8A34DC58CE2640C6DCBA42
Malicious:	false
Preview:	Dec 19 14:10:26 galassia systemd-logind[6779]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 19 14:10:26 galassia systemd-logind[6779]: User enumeration failed: Invalid argument.Dec 19 14:10:26 galassia systemd-logind[6779]: User of session 2 not known..Dec 19 14:10:26 galassia systemd-logind[6779]: Session enumeration failed: No such file or directory.Dec 19 14:10:26 galassia systemd-logind[6779]: Watching system buttons on /dev/input/event0 (Power Button).Dec 19 14:10:26 galassia systemd-logind[6779]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 19 14:10:26 galassia systemd-logind[6779]: New seat seat0..Dec 19 14:10:40 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 19 14:10:41 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 19 14:10:41 galassia systemd-logind[6779]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.459526019450492
Encrypted:	false
SSDEEP:	3:F31HlNEnzMWN1EnzMW9:F39WjW
MD5:	B88276D49409231B760AE1E75A7B142E
SHA1:	487B76CB3CBF76F9003962C0F43D55DCF1F4949F
SHA-256:	95BA5B2EEA4A9A88DD23690609DFBCC73D39F48C091FD5DBD3ECE2188F5A501D
SHA-512:	D906F6C602185160FFFBACC06F331DCBEC197CF8C6D8F0D0197E6998F27BF94544B11A8CE4E08AEB22BE20EBB9F5A65C2D4309D34B009FCB0617F4165BCC6029
Malicious:	false
Preview:	LPKSHHRH................../Bw...... ................................../Bw...... ........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31Hl54QMblt/h4QMbPX:F3J4PXp4P
MD5:	3B2C6376A1275C2B6633D1A9ECD17060
SHA1:	BEF10D1B21DD7C32C25850E241F163D6A162AA59
SHA-256:	B2BDA1A83B66070884E775506C91CC72DDC445034A16AA76648454383172B959
SHA-512:	67CB8D279246E356D917DB948F6005AA0A0294345CD0C78350CCBA31ED2623E2AC959BF17BC0FE74979BEBD3030677C43D68D03DF1C8447724BEF3ADDCE5BF65
Malicious:	false
Preview:	LPKSHHRH...................]u.CY...n...}...................................]u.CY...n...}........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12189
Entropy (8bit):	4.962885584190315
Encrypted:	false
SSDEEP:	96:9uzh7s+YJ/lnzZCPk7V+v1gAC8EfzYWOr8Mmh2/YL7e6uiGft4F4tWWftDfTrfTS:w5eRQTNr8A9dVceNLrxYvnnB
MD5:	4C4912B596A4A0A57F2F68B5594301D8
SHA1:	3ABB22E2A20D2F1B5BAAEECDF5EB7281F1800E8F
SHA-256:	C66BB203FBE97AFA645D6C46856C62B10A8AB56D6309AD7195CCF219DA1FA3E7
SHA-512:	17E384E2FDB747EA9CC4368E6C5ECD95BF220647A457E0669FD44111D9FEC9C91E8B1C4041CA13FD12EA865E2C279F3EAB4EEF98179EFA3AF08BA3DFD929B65A
Malicious:	false
Preview:	Dec 19 14:10:14 galassia kernel: [ 557.580434] New task spawned: old: (tgid 6770, tid 6770), new (tgid: 6770, tid: 6775).Dec 19 14:10:14 galassia kernel: [ 558.263189] blocking signal 9: 6210 -> 658.Dec 19 14:10:14 galassia kernel: [ 558.269337] blocking signal 9: 6210 -> 720.Dec 19 14:10:14 galassia kernel: [ 558.273646] blocking signal 9: 6210 -> 772.Dec 19 14:10:14 galassia kernel: [ 558.282566] blocking signal 9: 6210 -> 936.Dec 19 14:10:14 galassia kernel: [ 558.286552] blocking signal 9: 6210 -> 2048.Dec 19 14:10:14 galassia kernel: [ 559.499700] New task spawned: old: (tgid 6841, tid 6841), new (tgid: 6841, tid: 6845).Dec 19 14:10:14 galassia kernel: [ 559.502550] New task spawned: old: (tgid 6841, tid 6841), new (tgid: 6841, tid: 6846).Dec 19 14:10:14 galassia kernel: [ 559.535057] New task spawned: old: (tgid 6841, tid 6846), new (tgid: 6841, tid: 6847).Dec 19 14:10:15 galassia kernel: [ 559.889092] New task spawned: old: (tgid 6844, tid 6844), new (tgid: 6850, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	33185
Entropy (8bit):	5.102368003435292
Encrypted:	false
SSDEEP:	768:KHNGf7x1f7x1f7xvs6+4AEuUaWQ6LPbBfLflA6T8o2KYMSr:s8goI6i
MD5:	A427C3AD9175B0C81467C1F45890AB8C
SHA1:	FA17E1D7A61F22AC6F83603FFAED00F8BE2D6A43
SHA-256:	93A163ABC340C8A42E47B1950DB02416C3493612AC6FFAF4965C5E6F3B94D3AE
SHA-512:	1FD66671A8B240CA1DAA3E7C6A84ECA34558E0F95E4340AC592C837D0C266773C353F9AF7739E97F34925FB6588A89D635A9CDBA1E78878FF1FE3C27C3080F9F
Malicious:	false
Preview:	Dec 19 14:10:14 galassia kernel: [ 557.580434] New task spawned: old: (tgid 6770, tid 6770), new (tgid: 6770, tid: 6775).Dec 19 14:10:14 galassia kernel: [ 557.967823] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 19 14:10:14 galassia kernel: [ 557.970594] systemd[1]: Stopped Journal Service..Dec 19 14:10:14 galassia kernel: [ 557.973318] systemd[1]: Starting Journal Service....Dec 19 14:10:14 galassia kernel: [ 557.992043] systemd[1]: systemd-logind.service: Main process exited, code=killed, status=9/KILL.Dec 19 14:10:14 galassia kernel: [ 557.992099] systemd[1]: systemd-logind.service: Failed with result 'signal'..Dec 19 14:10:14 galassia kernel: [ 557.993057] systemd[1]: systemd-logind.service: Scheduled restart job, restart counter is at 5..Dec 19 14:10:14 galassia kernel: [ 557.993069] systemd[1]: Stopped Login Service..Dec 19 14:10:14 galassia kernel: [ 557.993100] systemd[1]: Condition check resulted in Load Kernel Module drm

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6516795542818554
Encrypted:	false
SSDEEP:	3:gSsXlXEWtl/Dl/:gv+ylr
MD5:	D3034D0F71CCA0E981426C5416163F19
SHA1:	684AFAEF84E9A1AD381051BD1815F5FA86A0703E
SHA-256:	78A8F4B46FE7EBBA6C0FDCB2B64EC956FAA18C0B43D51797417C9B127190B53B
SHA-512:	52E756618AC16BCCF22E8A0D1103CDA28F4302B5EA35D82B358C82A70E4ED63C1A3C6F792D3096A18B777B13FAB3CFEA8202EE0F9DC85C1AB3763AF55C8796B0
Malicious:	true
Preview:	........tty2.tty2.......................tty2LOGIN....................................................................................................................................................................................................................................................................................................}dgDQ......................................

Source: global traffic	TCP traffic: 192.168.2.23:38184 -> 178.215.238.25:33966
Source: global traffic	TCP traffic: 192.168.2.23:50014 -> 89.190.156.145:7733

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.309918605726116
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wiewa64.elf
File size:	168'168 bytes
MD5:	54b9ab4ddfac7f9e5775ee57d8007fa5
SHA1:	89cae32bcd35b0738b12c7cbdb9ee996d87bcd7d
SHA256:	dca359aa16005da260dac76d5baec9360796211eff6e31341b5112dbc91e7fca
SHA512:	ab0d1a71bc59a219d0202be66872a4148a8794dfdd84e0ff4a8e4c4942d7108df1623bf38f2d2a8e6bb7dfe540b4dce09aba217117b91e1888049913ee1e8f38
SSDEEP:	3072:/+DuGSfrSgwTt4n3JzYQzdPljfEom6xaERVyVqCiZYSY/NCHVoroJizBj:/+CGSfrSgwTt45zYQs/1iZLVAoJizB
TLSH:	6BF34A17B4C1C8FDC4D6C1744BAEB53AAD71F0DE1238B16B27D4AA222E8DE305B1DA54
File Content Preview:	.ELF..............>.......@.....@.......h...........@.8...@.......................@.......@...............................................R.......R.....(.......@...............Q.td....................................................H...._........H........

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	167528
Section Header Size:	64
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	1
.text	PROGBITS	0x400100	0x100	0x1b516	0x0	0x6	AX	16
.fini	PROGBITS	0x41b616	0x1b616	0xe	0x0	0x6	AX	1
.rodata	PROGBITS	0x41b640	0x1b640	0x3aa0	0x0	0x2	A	32
.ctors	PROGBITS	0x520000	0x20000	0x18	0x0	0x3	WA	8
.dtors	PROGBITS	0x520018	0x20018	0x10	0x0	0x3	WA	8
.data	PROGBITS	0x520040	0x20040	0x8de8	0x0	0x3	WA	32
.bss	NOBITS	0x528e40	0x28e28	0x7100	0x0	0x3	WA	32
.shstrtab	STRTAB	0x0	0x28e28	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1f0e0	0x1f0e0	6.3726	0x5	R E	0x100000	.init .text .fini .rodata
LOAD	0x20000	0x520000	0x520000	0x8e28	0xff40	0.2384	0x6	RW	0x100000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 21:07:48.836276054 CET	52223	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:49.076733112 CET	53	52223	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:49.078396082 CET	57149	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:49.319802999 CET	53	57149	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:50.709357023 CET	59458	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:50.948947906 CET	53	59458	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:50.982410908 CET	57425	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:51.116695881 CET	53	57425	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:52.525356054 CET	53112	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:52.659744978 CET	53	53112	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:52.661689043 CET	58831	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:52.901906967 CET	53	58831	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:54.290647984 CET	36187	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:54.424984932 CET	53	36187	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:54.426182032 CET	49086	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:54.561218977 CET	53	49086	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:55.948203087 CET	43712	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:56.083415985 CET	53	43712	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:56.084168911 CET	58255	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:56.218224049 CET	53	58255	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:57.647564888 CET	34487	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:57.781563044 CET	53	34487	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:57.782636881 CET	34531	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:58.024050951 CET	53	34531	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:59.452569962 CET	59178	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:07:59.910183907 CET	53	59178	8.8.8.8	192.168.2.23
Dec 19, 2024 21:07:59.911530972 CET	41910	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:00.152885914 CET	53	41910	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:01.565412998 CET	58606	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:01.699685097 CET	53	58606	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:01.700930119 CET	57897	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:01.835911036 CET	53	57897	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:03.311935902 CET	44239	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:03.446294069 CET	53	44239	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:03.447393894 CET	52905	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:03.581336021 CET	53	52905	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:04.973541021 CET	54784	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:05.109447956 CET	53	54784	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:05.110279083 CET	37674	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:05.244752884 CET	53	37674	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:06.635471106 CET	42234	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:06.874803066 CET	53	42234	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:06.875655890 CET	52679	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:07.010648966 CET	53	52679	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:08.399172068 CET	44394	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:08.533015966 CET	53	44394	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:08.534142017 CET	44888	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:08.667979002 CET	53	44888	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:10.060112000 CET	59615	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:10.194719076 CET	53	59615	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:10.195749044 CET	42501	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:10.330238104 CET	53	42501	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:11.732948065 CET	54183	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:11.867228985 CET	53	54183	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:11.868654013 CET	45835	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:12.002631903 CET	53	45835	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:13.419143915 CET	36258	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:13.553385973 CET	53	36258	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:13.554702044 CET	51328	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:13.689403057 CET	53	51328	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:15.077389956 CET	57338	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:15.212678909 CET	53	57338	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:15.213907003 CET	49464	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:15.348764896 CET	53	49464	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:16.745882988 CET	51864	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:16.869036913 CET	53	51864	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:16.870137930 CET	58631	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:17.004373074 CET	53	58631	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:18.392667055 CET	52647	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:18.526551962 CET	53	52647	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:18.527895927 CET	53565	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:18.661948919 CET	53	53565	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:20.059252977 CET	49335	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:20.197580099 CET	53	49335	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:20.198935032 CET	35598	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:20.332865000 CET	53	35598	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:21.720273972 CET	46789	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:21.854485989 CET	53	46789	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:21.855649948 CET	36828	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:21.978693962 CET	53	36828	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:23.366277933 CET	39709	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:23.500034094 CET	53	39709	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:23.501241922 CET	46998	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:23.635341883 CET	53	46998	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:25.023207903 CET	58259	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:25.158735037 CET	53	58259	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:25.161859989 CET	55469	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:25.300621033 CET	53	55469	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:26.785176039 CET	54486	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:26.918984890 CET	53	54486	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:26.920533895 CET	45922	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:27.057693005 CET	53	45922	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:28.475569963 CET	35672	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:28.610805035 CET	53	35672	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:28.612656116 CET	58584	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:28.746794939 CET	53	58584	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:30.148556948 CET	45202	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:30.272000074 CET	53	45202	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:30.274015903 CET	35488	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:30.408914089 CET	53	35488	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:31.870362043 CET	51266	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:32.004887104 CET	53	51266	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:32.007165909 CET	45935	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:32.141417980 CET	53	45935	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:33.568458080 CET	57963	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:33.702514887 CET	53	57963	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:33.703542948 CET	49622	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:33.838032007 CET	53	49622	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:35.238919973 CET	47509	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:35.373617887 CET	53	47509	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:35.375173092 CET	56130	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:35.497976065 CET	53	56130	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:36.904278040 CET	48976	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:37.038353920 CET	53	48976	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:37.043870926 CET	49629	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:37.167047024 CET	53	49629	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:38.590250969 CET	51423	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:38.723366976 CET	60244	53	192.168.2.23	1.1.1.1
Dec 19, 2024 21:08:38.723494053 CET	54959	53	192.168.2.23	1.1.1.1
Dec 19, 2024 21:08:38.724355936 CET	53	51423	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:38.732189894 CET	54314	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:38.854811907 CET	53	54314	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:38.860651970 CET	53	54959	1.1.1.1	192.168.2.23
Dec 19, 2024 21:08:38.950097084 CET	53	60244	1.1.1.1	192.168.2.23
Dec 19, 2024 21:08:39.570830107 CET	58500	53	192.168.2.23	1.1.1.1
Dec 19, 2024 21:08:39.709537029 CET	53	58500	1.1.1.1	192.168.2.23
Dec 19, 2024 21:08:40.252717972 CET	55015	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:40.375273943 CET	53	55015	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:40.382376909 CET	34972	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:40.516674042 CET	53	34972	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:41.910583019 CET	48822	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:42.045758963 CET	53	48822	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:42.052213907 CET	55759	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:42.175417900 CET	53	55759	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:43.605921984 CET	45272	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:43.728506088 CET	53	45272	8.8.8.8	192.168.2.23
Dec 19, 2024 21:08:43.732778072 CET	34335	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:08:43.867167950 CET	53	34335	8.8.8.8	192.168.2.23
Dec 19, 2024 21:09:02.474895954 CET	49597	53	192.168.2.23	1.1.1.1
Dec 19, 2024 21:09:02.611938000 CET	53	49597	1.1.1.1	192.168.2.23
Dec 19, 2024 21:09:18.722646952 CET	39581	53	192.168.2.23	1.1.1.1
Dec 19, 2024 21:09:18.862612963 CET	53	39581	1.1.1.1	192.168.2.23
Dec 19, 2024 21:10:19.375538111 CET	44100	53	192.168.2.23	1.1.1.1
Dec 19, 2024 21:10:19.375672102 CET	55081	53	192.168.2.23	1.1.1.1
Dec 19, 2024 21:10:19.512948990 CET	53	55081	1.1.1.1	192.168.2.23
Dec 19, 2024 21:10:19.596678019 CET	53	44100	1.1.1.1	192.168.2.23
Dec 19, 2024 21:10:37.444771051 CET	44298	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:37.580641031 CET	53	44298	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:37.581612110 CET	56830	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:37.704411983 CET	53	56830	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:39.202742100 CET	36227	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:39.336724043 CET	53	36227	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:39.338253975 CET	51567	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:39.472801924 CET	53	51567	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:41.080323935 CET	57378	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:41.215476990 CET	53	57378	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:41.217200041 CET	48866	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:41.340143919 CET	53	48866	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:42.930377007 CET	44784	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:43.065112114 CET	53	44784	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:43.211424112 CET	41457	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:43.346189976 CET	53	41457	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:44.912511110 CET	53944	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:45.047470093 CET	53	53944	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:45.214803934 CET	38795	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:45.350712061 CET	53	38795	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:46.852581024 CET	37536	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:46.987238884 CET	53	37536	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:47.112416983 CET	60003	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:47.235507965 CET	53	60003	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:48.990273952 CET	44466	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:49.112906933 CET	53	44466	8.8.8.8	192.168.2.23
Dec 19, 2024 21:10:49.220693111 CET	43032	53	192.168.2.23	8.8.8.8
Dec 19, 2024 21:10:49.354790926 CET	53	43032	8.8.8.8	192.168.2.23

Timestamp	Bytes transferred	Direction	Data
2024-12-19 20:08:45 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-19 20:08:46 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-19 20:08:46 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-19 20:08:47 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 19 Dec 2024 20:08:47 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	20:07:47
Start date (UTC):	19/12/2024
Path:	/tmp/wiewa64.elf
Arguments:	/tmp/wiewa64.elf
File size:	168168 bytes
MD5 hash:	54b9ab4ddfac7f9e5775ee57d8007fa5

Start time (UTC):	20:07:48
Start date (UTC):	19/12/2024
Path:	/tmp/wiewa64.elf
Arguments:	-
File size:	168168 bytes
MD5 hash:	54b9ab4ddfac7f9e5775ee57d8007fa5

Start time (UTC):	20:07:49
Start date (UTC):	19/12/2024
Path:	/tmp/wiewa64.elf
Arguments:	-
File size:	168168 bytes
MD5 hash:	54b9ab4ddfac7f9e5775ee57d8007fa5

Start time (UTC):	20:09:17
Start date (UTC):	19/12/2024
Path:	/tmp/wiewa64.elf
Arguments:	-
File size:	168168 bytes
MD5 hash:	54b9ab4ddfac7f9e5775ee57d8007fa5

Start time (UTC):	20:08:29
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:30
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:32
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:34
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:35
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:36
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:37
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:38
Start date (UTC):	19/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:08:39
Start date (UTC):	19/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wiewa64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6749/oom_score_adj

/proc/6918/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:1333238DggQQx

/run/systemd/journal/streams/.#9:1333243vKJcmA

/run/systemd/journal/streams/.#9:1333247w4YL9A

/run/systemd/journal/streams/.#9:2773000nChlxA

/run/systemd/journal/streams/.#9:2773002cUL30A

/run/systemd/journal/streams/.#9:2773088JfGNYA

/run/systemd/journal/streams/.#9:2773090vQIxky

/run/systemd/journal/streams/.#9:27731040dx0hz

/run/systemd/journal/streams/.#9:2773105ZIbEDy

/run/systemd/journal/streams/.#9:2773106EPLG6w

/run/systemd/journal/streams/.#9:27731071lWCty

/run/systemd/journal/streams/.#9:2773108zBnQzB

/run/systemd/journal/streams/.#9:5206052tEBqnA

/run/systemd/journal/streams/.#9:5253594s8hVBz

/run/systemd/journal/streams/.#9:5268347FwYb0z

/run/systemd/journal/streams/.#9:5268349MrEKCz

/run/systemd/journal/streams/.#9:60570972UHEPy

/run/systemd/journal/streams/.#9:6127343wjUCZx

Linux Analysis Report
wiewa64.elf

Start time (UTC):	20:08:40
Start date (UTC):	19/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	20:08:41
Start date (UTC):	19/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	20:08:44
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:45
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:55
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:56
Start date (UTC):	19/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	20:09:02
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:57
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:58
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	20:08:59
Start date (UTC):	19/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761