Edit tour

Linux Analysis Report
gnjqwpc.elf

Overview

General Information

Sample name:	gnjqwpc.elf
Analysis ID:	1578563
MD5:	f226cf9654c92ae86217069d8cf6982b
SHA1:	9b935b2931e9c9eab15d65b86ebd0980ec82d94a
SHA256:	8a6abd1dca4ad174c9449a99ee954dbdcce8a4a49c54d05ab9fa597709cf1f80
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1578563
Start date and time:	2024-12-19 22:21:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 39s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	gnjqwpc.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/153@28/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: gnjqwpc.elf

Runtime Messages

Command:	/tmp/gnjqwpc.elf
PID:	6247
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

gnjqwpc.elf (PID: 6247, Parent: 6172, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/gnjqwpc.elf

gnjqwpc.elf New Fork (PID: 6249, Parent: 6247)

gnjqwpc.elf New Fork (PID: 6251, Parent: 6249)

gnjqwpc.elf New Fork (PID: 6414, Parent: 6251)

sh (PID: 6414, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6416, Parent: 6414)

ps (PID: 6416, Parent: 6414, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnjqwpc.elf New Fork (PID: 6897, Parent: 6251)

sh (PID: 6897, Parent: 6251, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6899, Parent: 6897)

ps (PID: 6899, Parent: 6897, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6253, Parent: 1477)

sh (PID: 6253, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6253, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6258, Parent: 1)

systemd-hostnamed (PID: 6258, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6407, Parent: 1320)

Default (PID: 6407, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6413, Parent: 1320)

Default (PID: 6413, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6470, Parent: 1)

journalctl (PID: 6470, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6488, Parent: 1)

systemd-journald (PID: 6488, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6489, Parent: 1)

journalctl (PID: 6489, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6500, Parent: 1)

dbus-daemon (PID: 6500, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 6505, Parent: 1320)

Default (PID: 6505, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6511, Parent: 1860)

pulseaudio (PID: 6511, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6513, Parent: 1)

rsyslogd (PID: 6513, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6520, Parent: 1)

systemd-logind (PID: 6520, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6579, Parent: 1)

rtkit-daemon (PID: 6579, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6581, Parent: 1)

gpu-manager (PID: 6581, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6585, Parent: 6581)

sh (PID: 6585, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6586, Parent: 6585)

grep (PID: 6586, Parent: 6585, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6590, Parent: 6581)

sh (PID: 6590, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6592, Parent: 6590)

grep (PID: 6592, Parent: 6590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6594, Parent: 6581)

sh (PID: 6594, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6595, Parent: 6594)

grep (PID: 6595, Parent: 6594, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6598, Parent: 6581)

sh (PID: 6598, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6599, Parent: 6598)

grep (PID: 6599, Parent: 6598, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6600, Parent: 6581)

sh (PID: 6600, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6601, Parent: 6600)

grep (PID: 6601, Parent: 6600, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6602, Parent: 6581)

sh (PID: 6602, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6603, Parent: 6602)

grep (PID: 6603, Parent: 6602, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6608, Parent: 6581)

sh (PID: 6608, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6609, Parent: 6608)

grep (PID: 6609, Parent: 6608, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6610, Parent: 6581)

sh (PID: 6610, Parent: 6581, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6611, Parent: 6610)

grep (PID: 6611, Parent: 6610, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6584, Parent: 1)

polkitd (PID: 6584, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6591, Parent: 1)

agetty (PID: 6591, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gvfsd-fuse New Fork (PID: 6604, Parent: 2038)

fusermount (PID: 6604, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6614, Parent: 1)

generate-config (PID: 6614, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6615, Parent: 6614)

pkill (PID: 6615, Parent: 6614, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6618, Parent: 1)

gdm-wait-for-drm (PID: 6618, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6624, Parent: 1)

gdm3 (PID: 6624, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6627, Parent: 6624)

plymouth (PID: 6627, Parent: 6624, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

systemd New Fork (PID: 6628, Parent: 1)

accounts-daemon (PID: 6628, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6632, Parent: 6628)

language-validate (PID: 6632, Parent: 6628, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6633, Parent: 6632)

language-options (PID: 6633, Parent: 6632, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6634, Parent: 6633)

sh (PID: 6634, Parent: 6633, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6635, Parent: 6634)

locale (PID: 6635, Parent: 6634, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6636, Parent: 6634)

grep (PID: 6636, Parent: 6634, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6638, Parent: 1)

agetty (PID: 6638, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6639, Parent: 1)

rsyslogd (PID: 6639, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6644, Parent: 1)

gpu-manager (PID: 6644, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6645, Parent: 6644)

sh (PID: 6645, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6646, Parent: 6645)

grep (PID: 6646, Parent: 6645, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6649, Parent: 6644)

sh (PID: 6649, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6650, Parent: 6649)

grep (PID: 6650, Parent: 6649, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6651, Parent: 6644)

sh (PID: 6651, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6652, Parent: 6651)

grep (PID: 6652, Parent: 6651, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6655, Parent: 6644)

sh (PID: 6655, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6656, Parent: 6655)

grep (PID: 6656, Parent: 6655, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6657, Parent: 6644)

sh (PID: 6657, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6658, Parent: 6657)

grep (PID: 6658, Parent: 6657, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6659, Parent: 6644)

sh (PID: 6659, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6660, Parent: 6659)

grep (PID: 6660, Parent: 6659, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6721, Parent: 6644)

sh (PID: 6721, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6722, Parent: 6721)

grep (PID: 6722, Parent: 6721, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6724, Parent: 6644)

sh (PID: 6724, Parent: 6644, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6726, Parent: 6724)

grep (PID: 6726, Parent: 6724, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6648, Parent: 1)

dbus-daemon (PID: 6648, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6664, Parent: 1)

systemd-logind (PID: 6664, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6727, Parent: 1)

generate-config (PID: 6727, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6728, Parent: 6727)

pkill (PID: 6728, Parent: 6727, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6729, Parent: 1)

gdm-wait-for-drm (PID: 6729, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6733, Parent: 1)

rsyslogd (PID: 6733, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6740, Parent: 1)

dbus-daemon (PID: 6740, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6743, Parent: 1)

rsyslogd (PID: 6743, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6745, Parent: 1)

dbus-daemon (PID: 6745, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6753, Parent: 1)

systemd-logind (PID: 6753, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6810, Parent: 1)

journalctl (PID: 6810, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6811, Parent: 1)

systemd-journald (PID: 6811, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6812, Parent: 1)

agetty (PID: 6812, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6813, Parent: 1)

rsyslogd (PID: 6813, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6815, Parent: 1)

dbus-daemon (PID: 6815, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6820, Parent: 1)

systemd-logind (PID: 6820, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6880, Parent: 1)

gpu-manager (PID: 6880, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6881, Parent: 6880)

sh (PID: 6881, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6882, Parent: 6881)

grep (PID: 6882, Parent: 6881, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6884, Parent: 6880)

sh (PID: 6884, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6885, Parent: 6884)

grep (PID: 6885, Parent: 6884, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6886, Parent: 6880)

sh (PID: 6886, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6887, Parent: 6886)

grep (PID: 6887, Parent: 6886, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6889, Parent: 6880)

sh (PID: 6889, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6890, Parent: 6889)

grep (PID: 6890, Parent: 6889, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6892, Parent: 6880)

sh (PID: 6892, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6893, Parent: 6892)

grep (PID: 6893, Parent: 6892, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6895, Parent: 6880)

sh (PID: 6895, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6896, Parent: 6895)

grep (PID: 6896, Parent: 6895, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6900, Parent: 6880)

sh (PID: 6900, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6901, Parent: 6900)

grep (PID: 6901, Parent: 6900, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6902, Parent: 6880)

sh (PID: 6902, Parent: 6880, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6903, Parent: 6902)

grep (PID: 6903, Parent: 6902, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6906, Parent: 1)

generate-config (PID: 6906, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6907, Parent: 6906)

pkill (PID: 6907, Parent: 6906, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6908, Parent: 1)

journalctl (PID: 6908, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6910, Parent: 1)

gdm-wait-for-drm (PID: 6910, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6917, Parent: 1)

gdm3 (PID: 6917, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6920, Parent: 6917)

plymouth (PID: 6920, Parent: 6917, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6934, Parent: 6917)

gdm-session-worker (PID: 6934, Parent: 6917, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6938, Parent: 6934)

gdm-wayland-session (PID: 6938, Parent: 6934, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6940, Parent: 6938)

dbus-daemon (PID: 6940, Parent: 6938, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6942, Parent: 6940)

dbus-daemon New Fork (PID: 6943, Parent: 6942)

false (PID: 6943, Parent: 6942, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6944, Parent: 6938)

dbus-run-session (PID: 6944, Parent: 6938, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6945, Parent: 6944)

dbus-daemon (PID: 6945, Parent: 6944, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6948, Parent: 6917)

Default (PID: 6948, Parent: 6917, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6949, Parent: 6917)

Default (PID: 6949, Parent: 6917, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6921, Parent: 1)

accounts-daemon (PID: 6921, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6925, Parent: 6921)

language-validate (PID: 6925, Parent: 6921, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6926, Parent: 6925)

language-options (PID: 6926, Parent: 6925, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6927, Parent: 6926)

sh (PID: 6927, Parent: 6926, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6928, Parent: 6927)

locale (PID: 6928, Parent: 6927, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6929, Parent: 6927)

grep (PID: 6929, Parent: 6927, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6930, Parent: 1)

polkitd (PID: 6930, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6963, Parent: 1860)

dbus-daemon (PID: 6963, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6964, Parent: 1860)

pulseaudio (PID: 6964, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6965, Parent: 1)

rtkit-daemon (PID: 6965, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6970, Parent: 1)

journalctl (PID: 6970, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6971, Parent: 1)

agetty (PID: 6971, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6972, Parent: 1)

dbus-daemon (PID: 6972, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6975, Parent: 1)

systemd-logind (PID: 6975, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 7006, Parent: 1)

rsyslogd (PID: 7006, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7034, Parent: 1)

systemd-journald (PID: 7034, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 7035, Parent: 1)

dbus-daemon (PID: 7035, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7036, Parent: 1860)

pulseaudio (PID: 7036, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7037, Parent: 1)

rsyslogd (PID: 7037, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7041, Parent: 1)

gpu-manager (PID: 7041, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7045, Parent: 7041)

sh (PID: 7045, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7046, Parent: 7045)

grep (PID: 7046, Parent: 7045, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7047, Parent: 7041)

sh (PID: 7047, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7048, Parent: 7047)

grep (PID: 7048, Parent: 7047, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7050, Parent: 7041)

sh (PID: 7050, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7051, Parent: 7050)

grep (PID: 7051, Parent: 7050, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7052, Parent: 7041)

sh (PID: 7052, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7053, Parent: 7052)

grep (PID: 7053, Parent: 7052, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7054, Parent: 7041)

sh (PID: 7054, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7055, Parent: 7054)

grep (PID: 7055, Parent: 7054, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7059, Parent: 7041)

sh (PID: 7059, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7060, Parent: 7059)

grep (PID: 7060, Parent: 7059, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7068, Parent: 7041)

sh (PID: 7068, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7069, Parent: 7068)

grep (PID: 7069, Parent: 7068, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7070, Parent: 7041)

sh (PID: 7070, Parent: 7041, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7071, Parent: 7070)

grep (PID: 7071, Parent: 7070, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7057, Parent: 1)

rtkit-daemon (PID: 7057, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 7063, Parent: 1)

polkitd (PID: 7063, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7074, Parent: 1)

generate-config (PID: 7074, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7075, Parent: 7074)

pkill (PID: 7075, Parent: 7074, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7078, Parent: 1860)

dbus-daemon (PID: 7078, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7081, Parent: 1)

journalctl (PID: 7081, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 7084, Parent: 1)

gdm-wait-for-drm (PID: 7084, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7089, Parent: 1)

gdm3 (PID: 7089, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7092, Parent: 7089)

plymouth (PID: 7092, Parent: 7089, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7102, Parent: 7089)

gdm-session-worker (PID: 7102, Parent: 7089, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7110, Parent: 7102)

gdm-wayland-session (PID: 7110, Parent: 7102, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7112, Parent: 7110)

dbus-daemon (PID: 7112, Parent: 7110, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7116, Parent: 7112)

dbus-daemon New Fork (PID: 7117, Parent: 7116)

false (PID: 7117, Parent: 7116, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7118, Parent: 7110)

dbus-run-session (PID: 7118, Parent: 7110, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7119, Parent: 7118)

dbus-daemon (PID: 7119, Parent: 7118, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7121, Parent: 7089)

Default (PID: 7121, Parent: 7089, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7122, Parent: 7089)

Default (PID: 7122, Parent: 7089, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7093, Parent: 1)

accounts-daemon (PID: 7093, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7097, Parent: 7093)

language-validate (PID: 7097, Parent: 7093, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7098, Parent: 7097)

language-options (PID: 7098, Parent: 7097, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7099, Parent: 7098)

sh (PID: 7099, Parent: 7098, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7100, Parent: 7099)

locale (PID: 7100, Parent: 7099, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7101, Parent: 7099)

grep (PID: 7101, Parent: 7099, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7108, Parent: 1)

systemd (PID: 7108, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7113, Parent: 7108)

systemd New Fork (PID: 7114, Parent: 7113)

30-systemd-environment-d-generator (PID: 7114, Parent: 7113, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7123, Parent: 7108)

systemctl (PID: 7123, Parent: 7108, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7126, Parent: 7108)

pulseaudio (PID: 7126, Parent: 7108, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7129, Parent: 7108)

dbus-daemon (PID: 7129, Parent: 7108, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
gnjqwpc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
gnjqwpc.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f7c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f804:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f818:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f82c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f840:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f854:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f868:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f87c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f890:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f908:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f91c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6247.1.00007f3504001000.00007f3504024000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6247.1.00007f3504001000.00007f3504024000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x1f7c8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7dc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f7f0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f804:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f818:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f82c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f840:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f854:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f868:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f87c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f890:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8a4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8b8:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8cc:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8e0:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f8f4:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f908:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f91c:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f930:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f944:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1f958:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: gnjqwpc.elf PID: 6247	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: gnjqwpc.elf PID: 6247	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x10297:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102ab:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102bf:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102d3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102e7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x102fb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1030f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10323:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10337:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1034b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1035f:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10373:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10387:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x1039b:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103af:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103c3:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103d7:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103eb:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x103ff:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10413:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x10427:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6513)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6639)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6733)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6743)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6813)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7037)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6488)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6917)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6940)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 7034)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7089)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7112)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7119)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7108)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.165.dr, syslog.115.dr, syslog.171.dr, syslog.294.dr, syslog.43.dr, syslog.183.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 38366
Source: unknown	Network traffic detected: HTTP traffic on port 38366 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: gnjqwpc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6247.1.00007f3504001000.00007f3504024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: gnjqwpc.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 797, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4439, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4440, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4441, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4442, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4469, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4500, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 5942, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6083, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6267, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6268, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6269, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6270, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6271, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6272, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6273, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6274, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6275, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6276, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6410, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6411, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6412, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6414, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6416, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6511, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6591, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6637, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6643, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6648, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6732, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6732, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6488, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6729, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6511, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6813, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6814, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6815, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6897, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6899, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6917, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6963, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6964, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6972, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 7006, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 7033, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 797, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4439, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4440, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4441, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4442, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4469, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4476, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 4500, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 5942, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6083, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6197, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6205, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6208, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6232, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6233, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6258, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6260, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6261, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6262, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6263, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6265, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6266, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6267, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6268, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6269, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6270, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6271, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6272, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6273, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6274, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6275, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6276, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6410, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6411, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6412, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6414, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6416, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6500, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6511, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6513, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6591, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6637, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6638, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6639, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6643, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6648, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6732, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6732, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6733, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6739, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6740, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6488, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6729, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6741, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6743, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6744, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6745, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6511, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6811, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6812, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6813, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6814, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6815, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6820, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6897, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6899, result: no such process	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6917, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6963, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6964, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6970, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 6972, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 7006, result: successful	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	SIGKILL sent: pid: 7033, result: successful	Jump to behavior

Source: gnjqwpc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6247.1.00007f3504001000.00007f3504024000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: gnjqwpc.elf PID: 6247, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/153@28/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6500)	File: /proc/6500/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6604)	File: /proc/6604/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6648)	File: /proc/6648/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6740)	File: /proc/6740/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6745)	File: /proc/6745/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6815)	File: /proc/6815/mounts
Source: /usr/bin/dbus-daemon (PID: 6940)	File: /proc/6940/mounts
Source: /usr/bin/dbus-daemon (PID: 6945)	File: /proc/6945/mounts
Source: /usr/bin/dbus-daemon (PID: 6963)	File: /proc/6963/mounts
Source: /usr/bin/dbus-daemon (PID: 7035)	File: /proc/7035/mounts
Source: /usr/bin/dbus-daemon (PID: 7078)	File: /proc/7078/mounts
Source: /usr/bin/dbus-daemon (PID: 7112)	File: /proc/7112/mounts
Source: /usr/bin/dbus-daemon (PID: 7119)	File: /proc/7119/mounts
Source: /usr/bin/dbus-daemon (PID: 7129)	File: /proc/7129/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6253)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6253)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6258)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76362P76VUL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76363T3sPHL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76592Tjlb0M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76612EEFFnL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:7661564hrON	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76780ya45vO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:76781PgheWO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:767952YXjsM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:77989PpLW1L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:77990nrL3sO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78042xSfp3K	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78043gc4QlL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78044UB744L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:781396c3ZUN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78167yv5JkN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78262wAA0VL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78277gQLlEN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78440D6ChJO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78516aYRhAO	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78532KnxnEM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:78546pV35wM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:79744wKBDjL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:79818jsxLBN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:80001dvidwP	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:80002bqOxFM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	File: /run/systemd/journal/streams/.#9:80117mbxIxL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6520)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6520)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6520)	File: /run/systemd/seats/.#seat0EOpzGe	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6584)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6664)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6664)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6664)	File: /run/systemd/seats/.#seat0CYFde8	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80658XvG32c	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80659k0iLTb	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80667OdbKnc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80675cRRmOc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80684qThnJe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80685LSLo3e	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80686IekYGd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80762nM8Yce	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80765uBy4Ub	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:80855ZkikTe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:81980PH0Cqd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:82018bSaWVd	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:820201ZAeqc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:8205652kHDe	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:82058Bc3pke	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:83009HoHZmc	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:83015PXy9Bf	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	File: /run/systemd/journal/streams/.#9:83044BLvMZc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6820)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6820)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6820)	File: /run/systemd/seats/.#seat0ZYHaJS
Source: /lib/systemd/systemd-logind (PID: 6820)	File: /run/systemd/users/.#127kadUfU
Source: /lib/systemd/systemd-logind (PID: 6820)	File: /run/systemd/users/.#127JUaZmR
Source: /lib/systemd/systemd-logind (PID: 6820)	File: /run/systemd/seats/.#seat08LPcVV
Source: /lib/systemd/systemd-logind (PID: 6820)	File: /run/systemd/users/.#1278ygKRU
Source: /lib/systemd/systemd-logind (PID: 6820)	File: /run/systemd/users/.#127J1NHzS
Source: /lib/systemd/systemd-logind (PID: 6820)	File: /run/systemd/users/.#127eFnprT
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6938)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6930)	Directory: /root/.cache
Source: /lib/systemd/systemd-logind (PID: 6975)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6975)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/seats/.#seat0Y5zL6C
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127Z3vUiA
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127plI1pC
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/seats/.#seat0j2WggC
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127KvUkjD
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127JFkAqD
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#12776LvcD
Source: /lib/systemd/systemd-logind (PID: 6975)	File: /run/systemd/users/.#127gEudDC
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430385ghHKG6
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430389mbjFh3
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430390BfWvr5
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430407Udgvj3
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:4304113ctel3
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430414wN3uM3
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430499D1CYy6
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:4305005Owcy3
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430514cxand6
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:4305155wpHi4
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430516u3Don5
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430522r6OXe3
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430523pjH4B5
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:430525A6OwU2
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:16217882VQYu5
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:1621888ebAEI6
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:1621948L67gJ6
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:1621950HVHAV5
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:2788265iLSam3
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:2795096QJdeV2
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:2796217PL5Gr5
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:2758590Iw7DU2
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:2758638JmyX13
Source: /lib/systemd/systemd-journald (PID: 7034)	File: /run/systemd/journal/streams/.#9:3386492R2CRp3
Source: /usr/lib/policykit-1/polkitd (PID: 7063)	Directory: /root/.cache
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7110)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7093)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7093)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7108)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7114)	Directory: <invalid fd (4)>/.config

Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6232/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6232/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6233/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6233/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6251)	File opened: /proc/116/cmdline	Jump to behavior

Source: /tmp/gnjqwpc.elf (PID: 6414)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/gnjqwpc.elf (PID: 6897)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6585)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6590)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6594)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6598)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6600)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6602)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6608)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6610)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6634)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6645)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6649)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6651)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6655)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6657)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6659)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6721)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6724)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6881)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6884)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6886)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6889)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6892)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6895)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6900)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6902)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6927)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7045)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7047)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7050)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7052)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7054)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7059)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7068)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7070)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7099)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6586)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6592)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6595)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6599)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6601)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6603)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6609)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6611)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6636)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6646)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6650)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6652)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6656)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6658)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6660)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6722)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6726)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6882)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6885)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6887)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6890)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6893)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6896)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6901)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6903)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6929)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7046)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7048)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7051)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7053)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7055)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7060)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7069)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7071)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7101)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6615)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6728)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6907)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7075)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6416)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6899)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /lib/systemd/systemd (PID: 7123)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6416)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6899)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 7034)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6591)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6638)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6812)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 6971)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6624)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6624)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6917)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6917)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7089)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7089)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7093)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7093)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6513)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6513)	Log file created: /var/log/kern.log
Source: /usr/bin/gpu-manager (PID: 6581)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6639)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6639)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6644)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6733)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6743)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6813)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6813)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6880)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7037)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7037)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7041)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/gnjqwpc.elf (PID: 6249)

File: /tmp/gnjqwpc.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6581)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6644)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6880)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7041)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6416)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6899)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6511)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6615)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6728)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6907)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 6964)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7036)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7075)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7126)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/gnjqwpc.elf (PID: 6247)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6258)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6488)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6511)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6513)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6581)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6591)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6638)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6639)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6644)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6733)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6743)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6811)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6812)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6813)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6880)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6934)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 6964)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6971)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 7034)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7036)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7037)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7041)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7102)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7126)	Queries kernel information via 'uname':

Source: gnjqwpc.elf, 6247.1.0000556d5bd41000.0000556d5bdf1000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: gnjqwpc.elf, 6247.1.00007ffdc03a3000.00007ffdc03c4000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.eRKMyz
Source: syslog.294.dr	Binary or memory string: Dec 19 15:24:55 galassia kernel: [ 600.058492] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: gnjqwpc.elf, 6247.1.0000556d5bd41000.0000556d5bdf1000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: syslog.294.dr	Binary or memory string: Dec 19 15:24:55 galassia kernel: [ 600.058468] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: gnjqwpc.elf, 6247.1.00007ffdc03a3000.00007ffdc03c4000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: gnjqwpc.elf, 6247.1.00007ffdc03a3000.00007ffdc03c4000.rw-.sdmp	Binary or memory string: tYmU/tmp/qemu-open.eRKMyz\D
Source: gnjqwpc.elf, 6247.1.00007ffdc03a3000.00007ffdc03c4000.rw-.sdmp	Binary or memory string: %s/qemu-op
Source: kern.log.43.dr	Binary or memory string: Dec 19 15:23:08 galassia kernel: [ 492.953623] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: gnjqwpc.elf, 6247.1.00007ffdc03a3000.00007ffdc03c4000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/gnjqwpc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/gnjqwpc.elf
Source: gnjqwpc.elf, 6247.1.00007ffdc03a3000.00007ffdc03c4000.rw-.sdmp	Binary or memory string: MPDIR%s/qemu-op
Source: kern.log.43.dr	Binary or memory string: Dec 19 15:23:08 galassia kernel: [ 492.953643] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6628)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6921)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7093)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: gnjqwpc.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.00007f3504001000.00007f3504024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gnjqwpc.elf PID: 6247, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: gnjqwpc.elf, type: SAMPLE
Source: Yara match	File source: 6247.1.00007f3504001000.00007f3504024000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: gnjqwpc.elf PID: 6247, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
gnjqwpc.elf	50%	ReversingLabs	Linux.Trojan.Mirai
gnjqwpc.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.25	true	false		high
raw.cardiacpure.ru	178.215.238.25	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.165.dr, syslog.115.dr, syslog.171.dr, syslog.294.dr, syslog.43.dr, syslog.183.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.24	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.25	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
162.213.35.24	njvwa4.elf	Get hash	malicious	Mirai	Browse
	qkehusl.elf	Get hash	malicious	Mirai	Browse
	wheiuwa4.elf	Get hash	malicious	Mirai	Browse
	iwir64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	Aqua.ppc.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	vqsjh4.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
	jwwofba5.elf	Get hash	malicious	Mirai	Browse
178.215.238.25	wiewa64.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	wiewa64.elf	Get hash	malicious	Mirai	Browse
	wkb86.elf	Get hash	malicious	Mirai	Browse
	njvwa4.elf	Get hash	malicious	Mirai	Browse
	wlw68k.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	vkjqpc.elf	Get hash	malicious	Mirai	Browse
	wriww68k.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	dvwkja7.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	wiewa64.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	njvwa4.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	spc.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	x86_64.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.25
	star.ppc.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Mirai, Moobot	Browse	162.213.35.24
raw.cardiacpure.ru	wiewa64.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.4

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	wiewa64.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wkb86.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wlw68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	vkjqpc.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	wriww68k.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dwhdbg.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	dvwkja7.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
LVLT-10753US	wiewa64.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wkb86.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wlw68k.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Aqua.i686.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Aqua.mpsl.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	Employee Benefits & Bonus Docs 2024.vbs	Get hash	malicious	AsyncRAT, VenomRAT	Browse	45.88.88.7
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	94.154.174.120
	CPNSQusnwC.exe	Get hash	malicious	DCRat	Browse	45.88.91.89
CANONICAL-ASGB	copy_netaddr.elf	Get hash	malicious	Xmrig	Browse	91.189.91.42
	wiewa64.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wkb86.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	njvwa4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	http://112.31.189.32:40158	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm6.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6943/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7117/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mden:mwn
MD5:	871BC4BC2657DECF258BC7414CAD6FE3
SHA1:	B4078FE329FF65622581EF7AAB9872513D888E2C
SHA-256:	A47DAB15FE7C865BC1FEDD7867EDABC7CE680FD843979EF23721FB6449375778
SHA-512:	DD63F816A15EFA33DEA60DF1CC3D7E5EBE8085561A3EEFA2C0A98F6E306DB5F0FB35FB75F06F91A576C4910E0E417E3AEDB5C3909ABA2102A602C36F581F09D2
Malicious:	false
Preview:	7089.

/run/systemd/journal/streams/.#9:16217882VQYu5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.4085680695360825
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmuY2VDV0qjs2BZZGu:SbFuFyLVIg1BAf+MuY2V50qjNTZD
MD5:	56DAEE43D7225000F5AB358522CB15C9
SHA1:	71E11D2CFE48F54869A49384E9FC293EF23BFE5B
SHA-256:	1F6A4F9B189C1B32A1EF7DC7BD9B409D40682EA01889AC132B9796138BA8FE0E
SHA-512:	41E74996A851D3D7C5723B277F15C4F3635746E17926E785F6293E61C8F12974937F70ACCE492F8543F821415C2BACF86614AD7A6B2E8C90CDCF00E8AF405DC6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d8eeaedfe7bf4755adf43f2709c99689.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:1621888ebAEI6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.430935771973845
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MvGQSNlgQ2jLTTIWTIL:qgFq6g10+f+MqD6EWEL
MD5:	766546918EC1B386D28A7A3F2D09F47D
SHA1:	074E05AF2C4D465ADC31623AFD3605099B52DED6
SHA-256:	4B8C99F3A653D5D1F3738268BB812214D686B040BCC7A41BF330CDFC8B32AE4A
SHA-512:	A7D16482FA0BB01CD7B875D62D79A47C14AF170E95558AD89A6B313F0C89AB7132F9A99D8D683E9986503943C2956EFFB408C3F9E32D5987A1B503ED62EEF3FD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=710d9c5759fa45fdb523be005979046a.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:1621948L67gJ6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4147163038765465
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzm/WzhdAvBEWvsq:SbFuFyLVK6g7/+BG+f+McWzhdBxMqjNq
MD5:	7176E93653A5048EB19AC7DB38353550
SHA1:	4055A1788AF3926551B7ACB42107ECA3E4369121
SHA-256:	3622AB6D5798B31500BC4A688E83BF57F13A70BA28C4C50AA2840320F1DB4007
SHA-512:	49CBA05E25350429864BF605CE7F638C4113A617B25E4890E3E6DF0921377639CA98C8B8673317670926C33F2235FBAB2D4B7B9166FDC07418A0F1F9E189607A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=908be65432c74550a21d856a65e79da3.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:1621950HVHAV5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.455956529414834
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm/0U5G9HhDmushgF:SbFuFyLVI6g7/+BG+f+MnGjs22jNq
MD5:	378B3CB3144EC01DAC995C5F8B32A2E9
SHA1:	DBC90B385856AA235AA1A86CA8B77DDAFAE49B28
SHA-256:	9D6DC1E096FF4FB219C79E64345B5E30EF49E5ACC21C39C1B92E9AC3877B90E4
SHA-512:	6D9D3A985C361BFAFEDD79C67D01859DAE4089ED7DBEC1B7137A4ABDBB2629311FE276412E0684CE667E2A43B962B870960455A83F76E466A2CD483B71CAC33E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=54561bdcef2c4878b6ca1b77f9288d27.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:2758590Iw7DU2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.3651710299839355
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+NfTIOb7Udc0ZjsiI:SbFuFyLVIg1BG+f+M+NfTl7D0ZjZcHjv
MD5:	2C3FD96F02083E0DC709D836FC601A03
SHA1:	CC5BCD6922F560E4AFF9F5F3A7107EB439D42044
SHA-256:	EDCE24826E33061678622E21C106CF7E40369E90FCE67481CDF976B06C265096
SHA-512:	03078DA95E4632C61095040BCAE2C76D0F0C02DB09E9D50D4E6C08A3935673B8CFD7E5DB714F8085882DAB86DB0340B69DF7DD594E559B66617669CBBEE80385
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4dd1abbd73614b8589e84818f9703398.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:2758638JmyX13

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.2917646638059805
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6GQPG/jDdu8AxsjsO:SbFuFyLVIg1BG+f+M6GQP6BzAqjtWL0
MD5:	85174A48829C1B3080732931C7F0332C
SHA1:	27ECC868A532D2C3D2D1A47D5D9EB88862F43F1D
SHA-256:	EBBED85FC505CA2E28EB4F001F9F6EF94061C304164226D2CF05A61FB13D5F16
SHA-512:	028D14DE44017A443AD67B105CDCA186E490BB8EF1448F33A597D9F96672500E6FEB4337A1B58A0F36D828E52F5D3AEC682626338D4D2587A4A9A43F8F799480
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0c45879d5f4d4ad484e8f08ee8ab0eba.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:2788265iLSam3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.415511230293594
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8IPaOWqjsicWmIEsi:SbFuFyLVIg1BG+f+M8ISTqjZcHBrt
MD5:	BC25E2198D2B6E6D9D99EF7FD243FAA0
SHA1:	1D79DFE4D2C207741180012C5BE151A9AAEB967E
SHA-256:	40987AE2333E4E0DF5C45CC033743BA3A0739E7383A403FF3EA19A0E600FED35
SHA-512:	81876D7360E49AC58B0FBB9C139A825CC1CD115FA1FCAF11CC007224522B186F18955D88644AA48134C5BB2BB4D53514A09ECBF75389288F6E3578D14FEE284D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=60d47055917a401da4785ca6b838ac6d.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:2795096QJdeV2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.515590975731226
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MojBAU0ZjFQMzKaBu:qgFqo6g7/+0+f+MoH0vTmh
MD5:	68F843B59A773FA514FB9C0AC62EE035
SHA1:	17B006254C06C11B259A329C5001B057FAF57A21
SHA-256:	92E73CA6C0FBA5C7493B84BAD3929793054D067963DFD616072451F07E83F2CA
SHA-512:	322E18002AD0EA10A6FA7CA89627421E79C94C1B13519B018610449D6C67F88CBB6E310580F1E9C3143ADF159CC61AB96FBBE4B5B53D700B7FD75BD297D4CB57
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b6859455d2424520bedaf198921643db.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:2796217PL5Gr5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.473391794171349
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MjGKjqjFQMzKaBu:qgFqdg7/+0+f+M6K8Tmh
MD5:	054E3693FDD887A91AB66A699B2536EE
SHA1:	95910C09CFE1B3CBC99571D85DD191A8AD900A6B
SHA-256:	70EFF54CADF9A68CFFD849278CC92567FD592AD8EACE520C387327310B626BA7
SHA-512:	25124FB75FA3D1012F2D32704F57FA0B9701E903F9A5758BEBBE5174AED217D8091C626D8B5432D963F8C89E2881B26682031EDBD0049D14148F9823C26AAA22
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=31c54ee636d74e039dda3099c34fd5ba.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:3386492R2CRp3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.380820266134041
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvPciASMvATjs1Han:SbFuFyLVIg1BG+f+MR5u8joa
MD5:	97CB5A70716A18FF4CAD4FB327A93453
SHA1:	85BB89514AD57FA8C48D05B4BC4F2A0FF3F052A1
SHA-256:	732C750C19DA4908885F4DCD7ADD9FEF137B9C936396836C74CD33AE4216A78D
SHA-512:	6CB2B7673DCD2DED07D971D62DF5126D7391BA6F425E8075F10BDAC7C3B0E85BADB02997387AE9D24B4E658335B1753FCA1CFA111E94A759266253B3681DC607
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e1332497ae634c2f8d3b7a4dbc301f99.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:430385ghHKG6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.476014355934341
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7kTT8+/3eJIgrqjsv:SbFuFyLVIg1BG+f+Mwf8+mJdrqji4s
MD5:	1A74784AA1A953DB82C2A38204A49A97
SHA1:	A510BAA56D7B73CB78DD10088A7E1B062EAEB025
SHA-256:	BA3FE78605B40D11D50C802BDA2F78A0E908D41A3C637B4EEE8D3A616E23E8C6
SHA-512:	4A55790434EB7B76720EDC0F8BF320C42EFAEADCED4D2DFCEC77B00BB47A8BA7219B417D15E77B2D4B3A73E4CAEECB86F7F41D91FD472113BC40095459F96382
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=19d4663e1e8a460ea31ef079c90ee267.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:430389mbjFh3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.421728411345782
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+AoLDSHHcaqjs1Ha7:SbFuFyLVIg1BG+f+M+AvHHcaqjosQu
MD5:	35CCEEF56504C1D855DA0FC7D3AE0A25
SHA1:	B30C22DCA42506AC164E0352F8A6C15C9120A43D
SHA-256:	90D5EAAFA2D0A597FFF0BCFC248D20A2A9987C48579E8C83D1D58D500AD38C9C
SHA-512:	B9F0A2C4697940000010F61104FB0D3D0F5D5A8BAEDD60DA4E6A0D6448065B2E1C3B626AE4CD5D50B18181B60B5E526AED95B37D7EE68C5F2058AFD23B21E80A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=462e0ecb6adc49aab28200607f385b97.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:430390BfWvr5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.459236090316158
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyU6kdWfqjZcHcljX+:qgFq6g10+f+Mn6UWMmAu
MD5:	693DCEC2283AFA80989B7320CCFCC1DC
SHA1:	F52801EE8B80DBD7A73123BB1AE5D3EC2254C814
SHA-256:	AAD4FC7652E9D4254A905C7CC5FE67E689BCE53E23E61F086A67DCE2C3D8C6FD
SHA-512:	18C4B3F39BE56EC60BE53B7DE7D581AA0E1FD171DDDEA139568E5AF711BE6ECA2E7C99B012FCF592A33698701134B95FA0568796EEED52A8D70DE4010CF8E7EC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=82ef5a0535184f6a9687d1deaa5e9d41.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:430407Udgvj3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.341495530591332
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmojcpgWHRB1v8jsmNm:SbFuFyLVIg1BG+f+MoxARIjdCLKzK
MD5:	5D02D09AF8D4B90AB5A2323FF0AB47C0
SHA1:	A99CAB22376B09B3C37BE51C9591B463A2E72CB0
SHA-256:	C448EE0AD6AF3C9E892174DD69C7EB02D608A1BEE30790391753D971019F8F8B
SHA-512:	AC01FF636B87B7129C836592D05AFABAED45537006033CCED22237C067E22DE7880D6F09C6EAAC2E506A7BE73BB7C1AD37720E4AAD77D1C889F89C3743252CB5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b116094455ae49d0a1b41d2fbba0ed46.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:4304113ctel3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.386525723047219
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7+RBc15yOsjs1Had9:SbFuFyLVIg1BG+f+MCBcfwjosQu
MD5:	E0A08D64F8A7CFCDA3DC85E7DABC09CA
SHA1:	6C06134CF38F69790F8552F05226EF42413B54E2
SHA-256:	C05374F5E76B1FC5FB6B48279FE902C60A10174EDCD955DADA0E20AADF1D900D
SHA-512:	20620131AA24071BBCB90042EDF9A095C7DACB6D956DD82D0E38D2509F113D78F5B65165D72C57767388B3DC9B1618A9595167FA660DED3BE70C543C28BE550E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1e5469d333ba4d93a4007dc1e4b6818a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:430414wN3uM3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.351010258872077
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm41EHHVd3cSLZjshQJ:SbFuFyLVIg1BG+f+M4OVWkZjtWL0
MD5:	6B76B9A6905754FD7941525B04267418
SHA1:	6D8BF5160B5C01B4F48E710AD20E9FFE3B44C7F5
SHA-256:	FDF21FC589221383FEE144D9010642A862FBC287AD82A6A1D1E3F7D102D4309D
SHA-512:	B20A1D54C9E7AD2D5BB7BD21CD48BEE706309E2FFDF4061B604B50C71AE44E2F40A7CAF500624C262C425BC2AD8D6EE4514F2EECC4267FFF14A8E666358E328F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=246abb08b9564af582a67e09af61a277.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:430499D1CYy6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.313149252110897
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+UG6PWEcDxj8jsmNm:SbFuFyLVIg1BG+f+M+UyEcDWjdCLKzK
MD5:	35BB7AF98B320DFF2F0EEF7F72D6A80F
SHA1:	DDB30DA006D3540B40879614AC0C557BC82FDC5E
SHA-256:	693351E55CF15092D761E30FE812237D3B071018347EF108CB118CAC21883F95
SHA-512:	78EF88F6ED6F358BD9E104EF0621B538C896A228635AC5CEC2FD5A276BF2EB41E6A32CF8A43D3BFFC77072F3DA059B4E8B2B9C32843E306102B55158A6F982C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4009ee9d5b3e46a4ab49a3a9f7e80e09.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:4305005Owcy3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.391181365403096
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6DGHy3rwgN5qjsjOA:SbFuFyLVIg1BG+f+M6DQ0rwu0jNE
MD5:	7BC2698DFA9740E6FDB6B6173E2484E9
SHA1:	0801EFC57E19B8B102D6FAE00A728BA7858B0B45
SHA-256:	1738C404363D4684E9334E29BCD0D878D871AFA8BA90E35A69DBB5AE303BE73E
SHA-512:	95D6E72D45256878A98121F4B5440665E14B7D1CED01245FF8207295A9B666705DE4C0C971F1ADC515496507EAA37C10E6591EB28BEDAB9A87137D7C5F5A3679
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=00c62e2864ab4144b0de0dc5ea3dfd28.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:430514cxand6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.410645936217595
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuqEYj/1RyA2rqjswK:SbFuFyLVIg1BG+f+MuW1E4jLkGq
MD5:	8A3A2744F2586458317D4210DE888B4B
SHA1:	06C757CE714C0668E10FEBDACFD767114501F802
SHA-256:	B2E18706CCDB6985BC81B7F14D0B035A87A8A358C57686930CDEF4EF8CD07BBB
SHA-512:	D5DA03473D7EEAD95C4B72E649BB732FE664FD8C5837860B4A82ACE97FD3B9B6C71656884286B0311E63DFD13B6A384B5E78A8C11C75A5C0BA8CB8BADC491051
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d973aca1ecbe4259afcb3e751bbb681f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:4305155wpHi4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.37219768913987
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/TrGSI6EUniLWTrq4:SbFuFyLVIg1BG+f+MeSl+inqjbVC
MD5:	74755009364F017156C818B0D703FE8B
SHA1:	A645BB87E88764DB504778CB3A97EDB35D739D54
SHA-256:	E9B391BF6B71D8735F99273C8E1DFF4EDEDC366BECF0EDA722AB3D1B429AFF7B
SHA-512:	5C40BC18E18FD0D8A210FFEBA5462B263AB2BC12C5B2E1D2DADFFD18A682A7E218875775FA4683060C64CE431EB51861680F5B1D1F31BEB87466F86DADDD0895
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=55c85ebc76724cd6a2a4d4abacec36ee.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:430516u3Don5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4107314104797055
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmudDD/Lf8Aglsjs2ALAQ:SbFuFyLVIg1BAf+Mudnrg2jNALyAZD
MD5:	BDCA66CE2CA451525A6B4AB20BE84AD0
SHA1:	A6721DEEACECC91C831D0FB5DB638560E9B0F242
SHA-256:	0A6E55C72D434109F1A5154D7B33BEFBA53D2AB1D8D8BC5F913592A5EFFDF21B
SHA-512:	DDDAEE36FF611DB2C61FECB36AD5A1B2BB2BEF32F43A78E37FFC7B2A2BC8F2147C9CA4F6056CBC16C1C8DEC1D41BFE99DC172CCA53785E5A55300C95E88B7A35
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da5635f3afaa4ff2b0052c61c5482dd2.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:430522r6OXe3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.330245164866347
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrJvK65cjtJy8js1Ha:SbFuFyLVIg1BG+f+MFH5cjtJy8joa
MD5:	57508B72A32E3F5B920B3481F2BD4F50
SHA1:	77930FA9B900EC319BC8DB307B76A07059A7F9F4
SHA-256:	A146B3094A66CAB95A5FA0F06DB06822D1B7BC652558886E2B99416AC5CB84C7
SHA-512:	6DB819F56FB351E0305C64E7A8674DF3345ED2560A093C7DC18F73E9175311743AA96DCA8CB9A5EDA5BA6F5615C32755009BA3D6E5365AC5B089953DC9494643
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a7361beb6ddc49a3bd9977a89bfeacbe.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:430523pjH4B5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.5119544805428715
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzlv5EURWzY+sjs7LH:SbFuFyLVIg1BG+f+M15EGWzYTji4s
MD5:	002AC9155A6E54D6E2DE54688F54E87E
SHA1:	7CBACCA08D01037DA7187B85CF33C02D6DA41CD4
SHA-256:	FD14744E720F12EB48CEE69ED84EF65D7D29DE09E5D834C484E6522B54E8B4EC
SHA-512:	42C2C87697E6FFBC76BA40E687BEB01828BF61C67E68848D5EFEED4E6363960A062FC1C832DAE543DC8FE6607085A7DF835CB4159B6A57A1462ED4883CBF7FEE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9e70a595ea0048b1887ffc59da683440.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:430525A6OwU2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.418351928236934
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+J3qBV7dI3osjs2BbQL:SbFuFyLVIg1BAf+M+FqBVC3xjNdQIeXD
MD5:	4E0E554708714564B615F450C2ABD620
SHA1:	2EDD0E2CED20761DA987C32A7AA77D98B6E5BEF4
SHA-256:	031B78832330CD977F438C09488D2D244481D0317ADD10369E796617DD3DF3C6
SHA-512:	DC12789526DF71737A44AD13F24400FCA4B9E676CF42E689164E8B8B9A7D755524FAB2BC332FCF117805F5450D4B3489C705B1C2855D6064D060F93A67EBCCA7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=41e39888334048249d7dc048a22008fa.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:76362P76VUL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.546557242967419
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5wrmhQ6Mt4Auxsjsv:SbFuFyLVIg1BG+f+Mrmuqji4s
MD5:	51AC68826EAF42F56CFC7085EF16C1B3
SHA1:	65300EE51004E14D88F09C25AAD7516E231EC3B4
SHA-256:	A2D23BEF99688A932ABB1A13804B40ED4772152CB4A34C8D5452050D94AEE60C
SHA-512:	F889B21C4D5CC98EA1DB3FB968328D1761F3D1A7EA968D75A33A7A661A8E22046C316CADC11F36FA816EE3C2B69D00229211FC62927609C95B45D20C068CB8C5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3793ff6d95d548acb87c9d51729d27ac.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76363T3sPHL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.485975292275369
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6UYRRGoVA5akAETjq:SbFuFyLVIg1BG+f+M6UYRRy5FzTji4s
MD5:	B393E26B6D99EE1286BCAF599F185690
SHA1:	9BC6649F2AC8E7063647C75B33786B0E9091C582
SHA-256:	8C01EFBB678F9D07A86A9D4D40F8E3605A56946A35DD1144BA6FBF47B26F8EBD
SHA-512:	D84F22EECECE773E27AA4415C3FB34768905F939D967F04958483D258E4D075A24A65F462D22040C7F7E18B1B55B87C703509A512FFA99856942CE5689C2A23C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=05dfa44c0fc84428a2c65e59acbae52e.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76592Tjlb0M

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.397354587395943
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp1A6/8RZTAuqjs1Ha:SbFuFyLVIg1BG+f+MA6/GkuqjosQu
MD5:	8C115F3415312900912997D13F986908
SHA1:	89C64DFC28030BCB95D0C42C5F0AE411C2224A00
SHA-256:	B22150CF8C99CCED0434C3DFCFAAB5ABAA4BA42650AEAF5E4C95A60A2453EA09
SHA-512:	0694735DF8955E479BD72A39CCA6B7A24F63152E77B9286483BF09DD6D3A83E89A7C277AFDD9C692FFACD48211DD3DD2DC0C3D72474327248352022B14E54835
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c5703b7fe6a74957941e15c077ab995e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:76612EEFFnL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.399153823113925
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrsQAXdy5LzRqjsmNm:SbFuFyLVIg1BG+f+MIQAXE5L4jdCLKzK
MD5:	7507541BC1491175582E67059DA7CEB6
SHA1:	F1EC36927B7CC644163CDBEAFFBFE4CC39C6FEB1
SHA-256:	0152775D975942EF5C1A92C8C294A39B7B63547E1617AC260C8F303A7DA09E9D
SHA-512:	58CD43710C2FE082F51367782A0D0C029904BAEEE426A929B5ADCEFC554919CD218676BA6062A183FB149A8DB46DA6FF3F71023B475208FA50F869FA535B9911
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a14836228af5410eb5287d15be9f208f.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:7661564hrON

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.390079290616473
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7NmQDdfTOPwhTjshQ:SbFuFyLVIg1BG+f+MsQkPwZjtWL0
MD5:	247BD209135A896B00A5C531C3EAFB26
SHA1:	1534A5B6BFA52CA0A4F92528668BD714A65A4C14
SHA-256:	7D90D1CADBD9241310A85E3A7736B330B5F8D7B30F0746A7B3D7E5E344D38693
SHA-512:	EEDE6AEDDB5C68A48D12EDA96738FD1A43D7408BEA3DB16358BB22137137837BE2539159838CBA9630890EC4BF714378370A7CBF881E124141A4BF97A06B6E25
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1f4bf3858d874ff092f1213ca6f58766.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:76780ya45vO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.488092979159779
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Ms2ui1DA8jZcHcljX+:qgFq6g10+f+Ms2ubqmAu
MD5:	377CE3D665C5A782EAB75CDAD84059E5
SHA1:	79E30E17F82A457D31D9E9C3C261652493183715
SHA-256:	B186F887EF78EB845CDE833CC28B5878FEC09506926E1BEA85A0D0117EF79340
SHA-512:	CA8C13D75A70D533C27B068711CAD1C92705A1D77E3E7DC9882DF1723CFD9FB7D43882F93F62D112D975DCF8F9DCADC758058BA2D5FE308AF01741318F052678
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fa4f2c68e891491bac3c143a5e5f9d51.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:76781PgheWO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.41546429363382
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8pWQkdMXHWD2FrxsO:SbFuFyLVIg1BG+f+M84Q1GD2FrqjNE
MD5:	EED1B98D4536B674968B705631D88331
SHA1:	BC2974901D02A6DD51C1591CD7659A38EFF6674B
SHA-256:	424423D9831A70E38444FBEC048A1B2DC7F5EE75CE59C96B27B7F2EFA321EF18
SHA-512:	E6429FE93CF1A8294807B03B7F10BEA613059FC3B47AFD63CE2768F207D0F1D74658B81E5E8FCE6324470EC224BA37AB4E1C4638830C971D9070D56E6AFFECF3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=63b7c33ae6ed4b35ba824050e735b3f1.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:767952YXjsM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.451663513800617
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu8xug43XRP8jshKJg:SbFuFyLVIg1BG+f+MuG4nN8jbVC
MD5:	C7C9CEEE8FE7C1AC58732E65EA6103C1
SHA1:	C1B00D017E756582C5F1A65944DCFE1245B1FB63
SHA-256:	375D700ABE1C28466445AE7DE9909AC12B547735A37B040C1DED29DA20A446DF
SHA-512:	9295D67100FD18FE895DD236BD6E02914B68A05D0D003A40C3842B4FB7FCE4BB5F1FB8D333A718F261A1DA4546235250C62C40CEB824019DB1EFC4327335212E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d178b78b3565495f96be844b25af471d.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:77989PpLW1L

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.424293727281392
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyBQMlM/EC7ZjswkCM:SbFuFyLVIg1BG+f+MymMO/EC7ZjLkGq
MD5:	1F393009CB2CA3CEB213715935AC4A99
SHA1:	299150C0CDAF92642936E01935C90557CD2600AA
SHA-256:	E280B072397092F414F77EDC3F734750608A84E2D04ACE5C14C88903D2DC63FD
SHA-512:	FDD79B0A77AF9DFA22BCA9E5645FD3210ADF89FEF359E09A27996F7257E73F52A395D880248EFEC8A1BD9288CF871D48C1A88735B1AFBF3F56B4168DD3DDD2A7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=88f5cae5b29743dcb08b1291c254c03f.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:77990nrL3sO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4008083007696746
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M43RTsXwEmjNALyAZD:qgFq6g1af+MGTcwrIZD
MD5:	A1C7435C9536548722F74FCB12A25EF1
SHA1:	91944F58949E322C47B8E46F89137D3638CF464D
SHA-256:	255C25ED0248DCAFD96092C9263A948AA76F21ABA68818DBE33E8F659136F245
SHA-512:	B17252ACEE8012DBAC80F87C03429AC832AB6A674E6B7AA9FC709BC1EBDC2B02EEF99346D7F6B42AF9365973EDDEB555F062D6C3356A57201E381158FB7D3B87
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9135581e0a1a46a6a54388082cf24ca0.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78042xSfp3K

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.488554506024297
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5LyWLhXHc6z5qjs2BbM:SbFuFyLVIg1BAf+MzNHc6z0jNdQIeXD
MD5:	B1413073D87C83765C64E5D0DD09B861
SHA1:	12943E88A72AB466CCCCFF47804C4F443C2C2508
SHA-256:	EF7E5A7A68D25A7EDD0F0EBE180A09CA1A68D621510EBFC5AE0F12FC17DD7E26
SHA-512:	BF60A4C3AF7EBA0A20442EB924D7C4FF7EE3F4F44AE758BC41DF0836DDF96AFA0C3404D514E83F25E1BBCA5CF39DF19E832576DA27F70F8620115CB80E106589
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=371f267a33c94442b99fc71d8369708f.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78043gc4QlL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.454442453130576
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MuU1J3WvAuqjdCt/rRMtq:qgFq6g10+f+M5douCDL
MD5:	972589F809F0362077F9C169579FBBE8
SHA1:	BCCE5CE8E925AA003731ED64E992760FD29E374A
SHA-256:	BA573CB267E84446A372AC37159B7A4EAFF4862F2E9B0F688E063B84193FC4C8
SHA-512:	D79A041B5DC20F1B477627478EF702FDAEEFA4521CE9194B69AAD82A9D44B598CECD2AE7C4C5DEC758A4B97B4D66F3B63AA8EBAC305D90F23B2B18769AFFCBF8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1d22adf72974fd0abc3c369d09e85c3.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78044UB744L

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.421327587782013
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmsDTQRGwW1W5Aglsjs2R:SbFuFyLVIg1BAf+MsDcgTjNTZD
MD5:	35916750E2EEEC26DB5A9997BEA7956C
SHA1:	5066F84A7A1E80A3D65F91A3BFC5AA4664225ADA
SHA-256:	88AC75AF7F892AE04014B4B36A2F93B923D688D4570997F831B5B1921D63B963
SHA-512:	44CA886838B7050F7011AC7B002FCB6B80BE425EC51989225B2960FD1085ECB2E4308EE197056149E1ABAF4396D7BBBBA2E16B13376BFA260B71CACA53085420
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=ff65597d0b7c43aab9ab2d1577817512.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:781396c3ZUN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.416214149973209
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MothbEqljLTTIWTIL:qgFq6g10+f+MozEmEWEL
MD5:	EC81DBB000D5710B3EF5D2D04B5FCD90
SHA1:	15831CEE8686165F449788E7AE48B7B1B19D9C3F
SHA-256:	62DCAA44815B21026543F657C5A7A610241EBD51CFE99AAECFE4C93DC8A863C3
SHA-512:	CF6D92AD57974583795F4240E1C284E0ACFF5BBD50FA831749D77E22F72BAF70258E535DDBEB4D5E678C95DC926B2102DDFA1DFC25DA335E8B73EB70A835F010
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b44b8ce521d84271acabcc7346e6d67b.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78167yv5JkN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.369639565962878
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M6amf4AZX2jdCLKzK:qgFq6g10+f+M/mfzsCLAK
MD5:	9F4EA172BE745595EC8001C87D73DA00
SHA1:	C6B7AF9C4AC158723B3D09E4C2DA60077209932A
SHA-256:	F8188D04A595EF52B80A3F9641636FF3A7C2F49B7DD79649207641753090B758
SHA-512:	D7406D7726EB537A5DB41002A68244C9E85CD44573332583DDBC23B0D7185D80591A1F14484FEF0E0D97E9722622DAC61332A1F53D74EF74EC3D082E069D5D9C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03822dbe11d64771bdfc71229e1be240.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78262wAA0VL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.411730371261743
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+ySxGpEH1tk92lsj+:SbFuFyLVIg1BG+f+M+ySxAu1KZjLkGq
MD5:	96736F48BF46F3B775CBF4DBC5F82D4D
SHA1:	A0B0FF3EF65700BA4A305F33C95AE73C55E1A2A7
SHA-256:	E52E9C89C1B8F389F7E9AEFA898D9DBB4F460E48AA8D87BA7C47BBFB88D4B134
SHA-512:	5450E159E31747032FAAB87E21192AFC704095F50E30B630799B5B5CAE0D492EB2CE9B9E96B08649FC85276AD772E073B32A3F47C3542C08DC1FFD0F67D35623
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4ce7f2765ec04d6ab4668e5475fd7331.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:78277gQLlEN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.380326193494244
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MOVcV45ELkjdCLKzK:qgFq6g10+f+M4SL2CLAK
MD5:	BF38D382BA1C14F65CDEE5CCD45BEAB2
SHA1:	E13150B28BAD614321CA6189D8E6375254E6409E
SHA-256:	B6786F0AE49C14EDEB3BDA1E384C2DAE753C7499B03B45166C5EB3BDBD2E2294
SHA-512:	5C4A3DC9D2D192A1A85E00ABB2305028053F48A0B003756AE974340722FC8C5ED3BA941DCBBAD9A17BF1FDAA4DE4344F6560C2E18E94694C9403A56F0BF5BA9D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e704419656344307b5ddca5a48463762.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78440D6ChJO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3982754984362495
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7wHIzRYfNPuqjs1Ha:SbFuFyLVIg1BG+f+M8HIz2TjosQu
MD5:	7BF7EABCADA5CA98E18A088235D22E1D
SHA1:	EC4EC3076DEE1A1C452F3D38861AE84F5B90DC76
SHA-256:	2E373D117DF640ED09D1479B57FC0A408D745F4138B61DF5397D6C85DFE3AE3D
SHA-512:	1F4F088D5D1FB3226B3E1C233274B92C42D31D2FB0DD93011DD7827ABB51B91C33ED8D5DD5E22968AB0B18EFE5EC421D8A99F2FB30D57475F03984813F9CF0C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1439eaa00e7e409a8eb236e253c16d78.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:78516aYRhAO

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.473342467805977
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MbQmG6Da4jZcHcljX+:qgFq6g10+f+M0mGo7mAu
MD5:	4C4ABF266ED6A74881231CE53EB310C8
SHA1:	10970CA9D2E8655F5016F0EEF75BDCF7C1CE76E7
SHA-256:	4EA870AF460F21AB2456ABD7F31DC96F7AA3125BE6BD702E344A781FCB4A1173
SHA-512:	B557E83F496F5D2B048C65D1E2682DB5A601C3DF433C26F18ECAE01AE60384EA47B0E60A8714BA8E315ADCE9491546DAC6003B0A3286027D3D7A2DF73CBF4E18
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a5b4abde27b642b696c402eaff4601bf.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:78532KnxnEM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4344010813053565
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmyTUdioXMW+Rk2lsjs2o:SbFuFyLVIg1BAf+MyGiocW+2jNALyAZD
MD5:	D8ADB3A064A0F9700C66C3F6904B58E1
SHA1:	BEB067EAB00D0D56CC19C8219F7412966BBC2432
SHA-256:	E95221390C498F9E2E2E250B796B7AA9ABB241652EEA7F6997766285E7A60B5A
SHA-512:	E3F96D99DAEFFB98A518AC5F734D1CAB24989E4EBDA7C8723D28E4EC633F003E31D4B7E659AA06E11F34C8D52D1CEF6B8830AD34160EA4ECB33E8A7A86074A8C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8ca15ab84bd1492ab25ae2f53cb37442.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78546pV35wM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.451619937756622
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5miGjHHtSc0g2js2BbM:SbFuFyLVIg1BAf+MvGjHHtQjNdQIeXD
MD5:	BB8BAAB323C36F1476716C4B0D7CE5A2
SHA1:	42D3C7C3046DD7547F5E42206B759A26F07CAA72
SHA-256:	AC8F3798639F192D3F4719AB0197E997FED96A9C0156C532D6137D15244AC94D
SHA-512:	919C307053B3D1CD944898E9F96DC44AF844666777EE7E4C98095A6EBFBA3A670D73A3E1091057A1D2F47EF54C7F3A6100AABAD5528BF7E76B93BFD92286E648
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=329b6a14700c4ecbbf4b4ac3990c0796.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79744wKBDjL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.396239866879375
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MoaL4HBadKjdCLKzK:qgFq6g10+f+MoaLmbCLAK
MD5:	A74EEAFE2837A9DE7F5F37E566DCAC25
SHA1:	8C1E575FBF0215DD3C5758CBEE2831EC10F591E3
SHA-256:	DDA94571431DB404A961C88899C84C3236FD08B1B5056EEE3EC69E189B0EEF68
SHA-512:	4CAF79B6EE85463345F707496B5D0FAEB21EE65FF485126C418217347E785AF51FDFF75C40F1DAB7973BE7C531CC091B3C8DBE6887C1F5F8FC372BD4B248D5CB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b246e4341b074d10854d0262fd8a809c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79818jsxLBN

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.418206401910031
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8DU/VJXXRhTjosQu:qgFq6g10+f+M8UJHRZQu
MD5:	E20F2493F0542303374AD535013EA4A6
SHA1:	5AA0D12DA9B88AE637EDCF31AFE2E2ABDB0FE16E
SHA-256:	B84353E3EB71025C8FC907E623A2862EBEEAE9D981202FFAC4E62A4D2692CF1C
SHA-512:	BE3F6DEDAC396CDC749FA58C9246C9D17A68F2987BCCC8F2DF3E7C99EE60E23CB01D1B7E79AE9DEF7BBE62257B06F7C6DFB54DE2965BF5CD1E61A63E60A63B7C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6f160d6e40e9481c8f5266e7062ce3e3.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80001dvidwP

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.3909350445343724
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuOHrlXEgGL2RqjsmM:SbFuFyLVIg1BG+f+MuoBXya8jdCLKzK
MD5:	2ECC05245693076ADED04B47FCCB1113
SHA1:	1E308285C628690778A1667CA9D83C41A4AD4B53
SHA-256:	C9221CD3C23F65F05174B40280945117B4DE2223206D75B34B1EF35EC99F7DCA
SHA-512:	FD345944BBE2B2F8CBE0D617ACD93F58DE5CE6F47E48C90B7858E4F5E5B1AC59E5773B7963CDE7F8C01957869179A431AB19F49889ACBB070F62344FDB177DD4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1d7cbba8af8440f9384a4ccc5f7a69d.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80002bqOxFM

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3918561725533065
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu5EUoikcUnlN2js16:SbFuFyLVIg1BG+f+Mu5WLlN2josQu
MD5:	FD4201FD441FC0F7DAC8AA4FAB133EC5
SHA1:	91684C659658540A5EF1D503BEE99143F7FC52F0
SHA-256:	B1BC67612461C13EFC9EF5F00DB5FA37888F209E5FDC8D9E0B4487852AD07A72
SHA-512:	A629A570CBB46DB2655BE3A99ABD91FCC15B9D41BD9DEA6291881128D826A7FE9E81DA92D237A2CC2CC8F76307DC0B6E7546692B86AE39E4BB463A446ED0C8A5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=da2ca115b4e447ed9ba5d016bb5b472f.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80117mbxIxL

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.49598087685755
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5GVmjyY+sjsicWmIo:SbFuFyLVIg1BG+f+MrjZcHcljX+
MD5:	5FB2FDBA2AFF8942EA8781720EDB8227
SHA1:	6101A21D72B1FC3268B0AB43B0F0E25EDD9C6AF3
SHA-256:	86F69923685A48E48F9765C31B927A5A050D7225877F8326B611E83AACE1D023
SHA-512:	D2EC62FC400A396304E4658DCDDCDA26779FB34FA3E4A364F789363BBE61C568136106784EB7C10783F392C044DA7F615E4D848453FC8219A04118D8E0D6B32E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3f94a0d3325f4808835d7b75fbaf7c42.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80658XvG32c

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.532265355040543
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmygvTpwM6V4js7LbgS:SbFuFyLVIg1BG+f+MyRMNji4s
MD5:	660BF3EDF445CA93E56F54F48A4C0C2C
SHA1:	1ED5BD158D22E0C9210EEB7BE14E72B39B8FE44F
SHA-256:	FC1277830F6D09A8C826E8856DEB0E0075EA4C4BE4470AC44C655CB525077FB6
SHA-512:	7CE396A96A6C416988025758F59D1C9220C9EB06C3AD5E5092174522597339928D18D8E8555A1E7B45D8D14CAAA1B01AE937D64CC3BA285CD3F21F6F6BF57B73
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8a306c388096475e98ed29a675d2734f.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80659k0iLTb

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.379365948589341
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MbGxV/Z7N2jdCLKzK:qgFq6g10+f+MizRSCLAK
MD5:	39CAA622796C4F0DACDF7D38D05DC8BB
SHA1:	BE6C42BB42BF566367D624F629D16793EDB38119
SHA-256:	4D48948A44B4E82C1A688DB5371CAEAF07F9F757DE9AFC0266275F17C9026437
SHA-512:	A9D3DA45CC74CAA2FFB3FA9FA13B9D67631C8DAC2822E129C3BBCED24CCAF3E6A628749038724827C21A3F23F990D5FD123224FC88E8A7A95E9088394773744B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a916017c99fd4822b494aac424c91f03.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80667OdbKnc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.4422191114433005
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmofG6SfR1js1HadmQ9:SbFuFyLVIg1BG+f+Mo41josQu
MD5:	2FA539435BBB41010E03B7E833288C74
SHA1:	1958FD52F757A4C540BDBCBB4AEC3DF0115D3835
SHA-256:	C02F1AA8F5DC0526B866AEFC71D1A677C033A251068E3166F721987845924A46
SHA-512:	231779B2D49D2B899EFE43C3E876C37AB1AD9D3C03C2CD85266C7A365DE4A16DE9D4777247359B4A5D91882D91BC0FDA7A3AD71CAF3247FE3B1C150D2559F234
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b378730d50c944fc9167f7d2fedd4324.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:80675cRRmOc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.503033690422521
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M+TTMe0gN2jZcHcljX+:qgFq6g10+f+MrehYmAu
MD5:	16CEE39352A99D4E31A60EB32CA5AF29
SHA1:	143A0E655FEFB38C5306E4EDE1A5053682AE4B1A
SHA-256:	98B36C345DB29CFF5F698BD6FB8BF9A823B89455AB16A743E556868A2A73B44C
SHA-512:	489AE16A2367727781E570388E1F6843240FC08AE18B52A3A16D6692421B6582AD4ED1B159769A4F1CFA944EC9F98243CC40797F9F6EDD7E77570362BD7F58E1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=43a48f261933418689685a7f624985d3.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:80684qThnJe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.418307609503332
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+dlG0FDcSRP/cs22S:SbFuFyLVIg1BG+f+M+fG0pPl22jLkGq
MD5:	705E857EC7F48F523824C9B41C0C2AA3
SHA1:	660C9CE821D1174AF9EF2F349641386478A1F0B3
SHA-256:	0D3EA6F176890284F7FEE6F46D49682C8E5D0FB6E63A689AACDC623621DADFEB
SHA-512:	FBAD8D30154DBF3AF2E590776A63E638FF636588DF5CEB11A48DC98A2DAE2789BBEC474379A8644DB2E464CA2EE1A17F4EFE8CD38F103F3579006C0D19E98A60
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4852e6b42fce418f894f930cc52e6007.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:80685LSLo3e

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.409348105453738
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+My5yh7G9UHjNALyAZD:qgFq6g1af+Mv8cIZD
MD5:	C16B2763C8604CAC912556C032C8DAE3
SHA1:	0CAB8CDFB8856B5FBE23AF0B89B785056906FD11
SHA-256:	1D68288C6DED84B34BEB30D92544341BC0C7898ED67B2CDA31CB299BF0826D4D
SHA-512:	4397A15C7631024365129C0C4F779F793C2AB7D6580FA5CA4EFD0DE6CCF41A89861BA1534F0CFF2C11A865A37F468A7C2C83ACF0C44E689A3B3C325DAC0879C0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8ea59d09e30d487baf0fb4d0855c0f17.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80686IekYGd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.514183785797581
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4DdUiXn5yjs7Lbgw3:SbFuFyLVIg1BG+f+M4BU0n4ji4s
MD5:	5EB2B03DA3F1FA6E7DD9669BD61D388E
SHA1:	3641ED4A78CF43086F9E93AC5394330B2D5E76EE
SHA-256:	49A80346C03B0AD9A37EEF9646B99C48DA5B6AA33B59F399FE9BCB455B89E0A1
SHA-512:	DF320C6E3E35A4D2890D9A7CF1ECB03BD9B5EB96C97EEC8D334AB22265AAF61F263503AB02B4BA2332FB587268E69C9D822C9A2BAE79DA0B1BC6D8F781C3A976
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=23a81b4ba8a3442bb29ba246b21c9c95.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:80762nM8Yce

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.504804889943977
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm/gSDB11zxCMETjs2BbM:SbFuFyLVIg1BAf+MISBwFTjNdQIeXD
MD5:	92B2C4DB225998049BC3F5AEABB015C3
SHA1:	98B7A86BDDF94A917A485D67FC1A8EFE9A757A02
SHA-256:	01DFA366B5CDAB40D9967848601E0F39BD4FB5081A4A42A919041FE222DF90C5
SHA-512:	690A547212FDEF23478956780EBAB6AF2C2379C534D88DFCCBFE586F2EFD8CFB0F970F6A57695A40EB91451414150FB8A496D5CE28BE908F8DFE288591A7EC42
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5943688282624df9ab6eb7c0f5ab51e4.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80765uBy4Ub

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.351477665521259
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm6hBVFRZ8QEtdV/vAuxy:SbFuFyLVIg1BAf+M6FrxENAuqjNTZD
MD5:	4F61B71412E7E343794DAC86B0D53802
SHA1:	A2963C9E64EC011444120CF058E1DA53582C9FAE
SHA-256:	1FCA8A2DC2EC3EEBDAE34F96B2753D5BC2604E41924F941BA97394F8B3FDEC49
SHA-512:	91CED219DC7E1F0AFF727CD1A17C5B1A3F2736A21BAA7F2267E90E550A69FB7596AFDE359836FD0EF7AAED45DABF389177F721129B70E3FB0A66BB48855E2CEF
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0fe5d824bb1346a0a540eb4faaa80a61.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:80855ZkikTe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.402241747607058
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5CHVrC+XFI0jswxJm:SbFuFyLVIg1BG+f+M8H1/jLTTIWTIL
MD5:	BFEB7A312970F38994BB957273FF2905
SHA1:	C1E8DB9678846366CB3ED51F825AA8F9C7CD9247
SHA-256:	EA29B19D06FA6E3264454AC4A9B7C543CA15C1AE72CFA906E84B22DE108346E0
SHA-512:	872AAB444325E6165FC6A8C55F582DD2CE75E9F27B25546E62B6A7830E48B677E3E6CEFCBDD984F3857B3B21CCD45130FF787CBC9E39E53EF373038EEC2DCAA4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3f15ac1b0efc404ba1e41c8ab2196045.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:81980PH0Cqd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.403292065210892
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvjaUMxBUVRRvAuxs4:SbFuFyLVIg1BG+f+MrfWql8jbVC
MD5:	CE519B684F7AB8019E0A94900E3811A6
SHA1:	DE6CF2FD4826E21FFDCF098F47CEACC132194347
SHA-256:	F74231A00C1103764892E589748C4ED9C5AF5906BD382F4265203DFED1DD8701
SHA-512:	17124A38D9594CB0F68302E52AEF1F34E09850DC40893083981D01DF10BC3C9C60A6254F448D4AA3B639EF707EE44BF0B299AF53E14ACAFE053D771C4476D042
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e086381f72db47ef9481dab3744d0e3b.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:82018bSaWVd

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.383434942491367
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm6g3Q48RCnaZjs2q:SbFuFyLVK6g7/+BG+f+M6gACnijNq
MD5:	8274B2F5A3729956D10402E5629F29A4
SHA1:	27D214545FE2B61B394B4E5615A25D5E788D4CBF
SHA-256:	11CDF30F1916142D82091C5E9E69D978A69AA28AE22193EEA4C6B06923FBD088
SHA-512:	039247ED1DAA70FF93F661F850C71425DA07E13465A160546FAD9536EF89907411B652BAB97DC15F75D71A6C356F7CFCD57362C714F7D8BAF2880EEB1ADC2525
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0760832a4dc642da97234b4ad1a302c4.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:820201ZAeqc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.374417377979501
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmvhUQ9HdZtWUk7BM:SbFuFyLVI6g7/+BG+f+MKmdaUwRjTjNq
MD5:	68CF4624D4FB8173E5C87559575F9B4D
SHA1:	9F9560AF66A073BDDCC71680E85D9EE3A9094E7B
SHA-256:	298A07E15D7594E31B6B6A429EC858A6DD80D437C9E4F14BBFFA9E005CD05721
SHA-512:	796DEEE3857D082770F749F47D9E37772900FC8A34F05061AC3596BF5D1F8A2100612903BBE6894F9BE77B866FEAC12BB16E25B4C36E3E09E6C5BF071A1778F7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e9515822b80040b3931302482499441d.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:8205652kHDe

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.552149623366303
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M7VuqjFQMzKaBu:qgFqo6g7/+0+f+MfTmh
MD5:	F2D692CE6C1B0D1AC305393A83D50C48
SHA1:	8803918F43A3558C23637A15D81E3F21B3B54702
SHA-256:	8BE823C90E3CE72256CA7E3B22FDC91ABD451F0EABC1B7B3A5453FD728BE2FB4
SHA-512:	8D3357B376CA6A2D1DFBE7BA9E3833EDD3C23A50B54188A13EF2766C65A97A09402C3D0E8B60380DF654AFC2652EDAD3D6A7E3118FBD9B2D7B96C9BFFDD479FA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=38168ea9fc944c788e2587655436651c.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:82058Bc3pke

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.487418061254716
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M8De2ATXUjFQMzKaBu:qgFqdg7/+0+f+M8D36uTmh
MD5:	C08B4BDCE9CE42C883BC9F83B34ADBA9
SHA1:	9B95245A16A0745045BD920B962E31F9BBD5CB31
SHA-256:	DDF4573F860C2F4656E55E8365E1FE2DDBDE036D7014FCB6EF33AA70CD5EDBFD
SHA-512:	6F8249ACB75D9B083A3E0C4881B2D536B422D565B857C7E5D6B9542BDEF3925EE6B7D6647A1F6D588440C5C921A0D8643EA4FEC461B999F5324275F91BA7DF10
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a54583eedfc1493ea0e4c4e3bb521c2b.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:83009HoHZmc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.331239263399071
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrPdm2wddEHR6VoAgC:SbFuFyLVIg1BG+f+MxoaHR+g2joa
MD5:	41A791E6141DB3FA7B9D5ECE83EC790A
SHA1:	229883766AAD1ECCF515C65E2C0B0ABA1D4934D2
SHA-256:	FCA753B7A1586C0B1931E0C7D016281167C4EC56624E66C86D147FD4CB9E537E
SHA-512:	82E130DE0CF967D7AB40B1424C8876A446AF1D1BBC62E607F186BE8B99BF0289A9D93956B7B90C90CE4D82B940740834545C7A57D732E31636775910E796C641
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aa548bce65e34ed18818b48f3fee4603.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:83015PXy9Bf

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.338073006183089
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm60H4KRVmjbtVuxsjt:SbFuFyLVIg1BG+f+M60H9SvtwqjtWL0
MD5:	C0152B1B786F506D595A01088B25AC5E
SHA1:	154243596F8AE828A6E82CDC819BA9A41687C1FF
SHA-256:	FB56782840DA6959978D7C0A312559DEF1CA2E40E10B50ADBF289E57FA92D4DE
SHA-512:	D0108E399373ABDD55716F99023AA01C422A5C6160154BD110C8BDD8E3F20B228C2D8057B5CFF3E3AC7D1364298C8ECF26774334BA3A3DB432AF53162D918713
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0f62f5bb46724655a0bccc4ca0a1bf41.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:83044BLvMZc

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.405354485720783
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzD3RBn+sjsjOdlJO:SbFuFyLVIg1BG+f+M/3bTjNE
MD5:	B71DCE1E31C400BCD65F5DC0203C4828
SHA1:	B17ED1BA68933EA72B098D6952FEA5F3C973F4C8
SHA-256:	0630E82F8DD9C89EF43BF0D613E4E20E8AD91FCF6CB12C23EA8131848403A4EC
SHA-512:	F9A8F7789ABCA4424DA44B0C6EB460DBB3BED81610F21DF55114E8CBE637E975395BB58E12774520D8F16BDD6AE3A39B9B9B6DAD1C23F279C3071D41C30EA38D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=95ce430dcac445cba680c09d0b7f3e53.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/seats/.#seat08LPcVV

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0CYFde8

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0EOpzGe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Y5zL6C

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0ZYHaJS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0j2WggC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#12776LvcD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.441366887137256
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8hhfJgBhZoTFt6kwiSv:qgFq30dABibBEhhBgROFI1iSv
MD5:	FD46EE7DB2C5F33013AA5D33E0111677
SHA1:	0D36AEA3126F3E60777690DFEF7D0194AF1FD70A
SHA-256:	83629B1B99A661E0F077A2F30701B6A9D56BAC7A3A22D0E4E54AADD7859773A9
SHA-512:	E8D6D0BD21B6C2EFCA1C45AD93892F58967692CF98779EFC8EE1AF408D13EEFF55E9F4B0FAE8FFE8907E79760D030C3B8C9D7C8A584275EB79536D0E6ACCC51A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14916.REALTIME=1734643491434262.MONOTONIC=596114618.LAST_SESSION_TIMESTAMP=596184477.

/run/systemd/users/.#1278ygKRU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.301575155023339
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8pJgBy+bRQ82thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBkrgY+bRQnthQHtPYb
MD5:	A7254C9725D237095F8356C2F41EDB41
SHA1:	CD99DD9BA06A69E52D3406F5484207DC2D634B30
SHA-256:	8E1787A8FD06949FA445719138778A7CC830D9012C4B186AF0D31D68A9A3B95E
SHA-512:	A7B36FFA4B02FCBB939F8A2D0EFAC24109A6E92A4E27588473F88694E08C7A9AD4ADC0752C7A86EF39C53E8418A96BBCEC39A5869FB8182F31C7C51A5F36A1B6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13876.REALTIME=1734643429647413.MONOTONIC=534327769.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127J1NHzS

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.284396983224097
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgBdQUgrqW0RQYpo206qodo3Bv:SbFuFyL3BVgdL87iesnAiRJgBy+bRQEI
MD5:	9816DE13F19543218119FF68297AB751
SHA1:	5AB972CA55FEBEAC76E8C1C55AD0FBF23CFAF8AF
SHA-256:	F6FFA5E187C2E4F71991F6A75B87FF1948338BBC28672538C2FDFE70193AB60E
SHA-512:	E812A06F09F3171DFF65233689675636C0BBF363D1A8F0059E8D5BB5C21EC2688CEB8B8497310E8A7ED1FD6732D7F0D5370452E461B5E5042055559E6DEF5387
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1734643429647413.MONOTONIC=534327769.LAST_SESSION_TIMESTAMP=534426660.

/run/systemd/users/.#127JFkAqD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.295076813970785
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgBdbh/39+TF206qodiYdiSv:SbFuFyL3BVgdL87iesnAiRJgBhZoTFtS
MD5:	9849D0D89ED834CA97B117FF32BF36E6
SHA1:	20EB7CF7350359975BE93F3DE5A83C336378EDB6
SHA-256:	986525848483603961D646019FA3E89FB49A38CF1FB052741C50A43FADFEB4EB
SHA-512:	05C5A2B912217CFF273AB31924D22D59FDA4A9BD278164B3149EB34E7E56A54F9E055878B383A08A0C66B3AC0070288D39CA2B62D212228E3EA86FF75EEA825D
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1734643491434262.MONOTONIC=596114618.LAST_SESSION_TIMESTAMP=596184477.

/run/systemd/users/.#127JUaZmR

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.301575155023339
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8pJgBy+bRQ82thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBkrgY+bRQnthQHtPYb
MD5:	A7254C9725D237095F8356C2F41EDB41
SHA1:	CD99DD9BA06A69E52D3406F5484207DC2D634B30
SHA-256:	8E1787A8FD06949FA445719138778A7CC830D9012C4B186AF0D31D68A9A3B95E
SHA-512:	A7B36FFA4B02FCBB939F8A2D0EFAC24109A6E92A4E27588473F88694E08C7A9AD4ADC0752C7A86EF39C53E8418A96BBCEC39A5869FB8182F31C7C51A5F36A1B6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13876.REALTIME=1734643429647413.MONOTONIC=534327769.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127KvUkjD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295215726003293
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8EpxJgBhZoTK2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEigROtthQHtPYq9M
MD5:	E99D8F0EAD74528D0D5E1E5BFD9BFB87
SHA1:	037256723299446F7C78FD2AF0DC3B61EDD09895
SHA-256:	8A73B851692FE7A49AF65EEB6C1FA5AD3A80B6A605ED81B471D13A9013445C79
SHA-512:	0F8A60253999BC5F0FF1C16C41FA7E9DE35745274397EF0F297BE322822BDFA76BA370DE62333C9B30AAB5A9CCE9FEDF9672A5C1AE4C40B532D286440CE3390A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14854.REALTIME=1734643491434262.MONOTONIC=596114618.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127Z3vUiA

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127eFnprT

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.46506290738454
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffZHTgBy+bRQEot6u3Z:qgFq30dABibBxzgY+bRQEoIuJ
MD5:	DDC492AC1F99E3384BF07A589B76DACA
SHA1:	2DC7A1B22010CBEC693B4B93C4619B295F85811C
SHA-256:	5F1D16263503953295F60DE0EE22E482CE5ABB011BDBB0E38D2FF50435B3B48F
SHA-512:	E7A511046B8A9940CD1315257712D024B651A2C1DC0A445906727032FDC1E07C0CCD0FCE2192F253D2E5C65C1DFF0B826F42B4290D9DD91472758638E5C8FBB6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13938.REALTIME=1734643429647413.MONOTONIC=534327769.LAST_SESSION_TIMESTAMP=534426660.

/run/systemd/users/.#127gEudDC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.441366887137256
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8hhfJgBhZoTFt6kwiSv:qgFq30dABibBEhhBgROFI1iSv
MD5:	FD46EE7DB2C5F33013AA5D33E0111677
SHA1:	0D36AEA3126F3E60777690DFEF7D0194AF1FD70A
SHA-256:	83629B1B99A661E0F077A2F30701B6A9D56BAC7A3A22D0E4E54AADD7859773A9
SHA-512:	E8D6D0BD21B6C2EFCA1C45AD93892F58967692CF98779EFC8EE1AF408D13EEFF55E9F4B0FAE8FFE8907E79760D030C3B8C9D7C8A584275EB79536D0E6ACCC51A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14916.REALTIME=1734643491434262.MONOTONIC=596114618.LAST_SESSION_TIMESTAMP=596184477.

/run/systemd/users/.#127kadUfU

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127plI1pC

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.295215726003293
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8EpxJgBhZoTK2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEigROtthQHtPYq9M
MD5:	E99D8F0EAD74528D0D5E1E5BFD9BFB87
SHA1:	037256723299446F7C78FD2AF0DC3B61EDD09895
SHA-256:	8A73B851692FE7A49AF65EEB6C1FA5AD3A80B6A605ED81B471D13A9013445C79
SHA-512:	0F8A60253999BC5F0FF1C16C41FA7E9DE35745274397EF0F297BE322822BDFA76BA370DE62333C9B30AAB5A9CCE9FEDF9672A5C1AE4C40B532D286440CE3390A
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14854.REALTIME=1734643491434262.MONOTONIC=596114618.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mWTv:mWj
MD5:	E6C3EBDB6F04A904BA94E3DCA9696D22
SHA1:	8BABD640CA3B1576C67543E10716426C29FA92B1
SHA-256:	5B2D93A356C82E0B557F288D3803D99E0C582059C0752F566C5F138ADEE38B3A
SHA-512:	98A95D346E633FA053BE0F1F21E9A3D60BB1C36F4DBE7C98C6CFFA3CE85BA210D2924BC994000175038A2AD506CCCE64374B854FADC1B2F8FF29539F7DB8C293
Malicious:	false
Preview:	7036.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nDvn:Dvn
MD5:	A1DC53A211F6E94E0BFD4FF853B9E6DF
SHA1:	8CF682295DC9A97FB9199BE46DDCC84DCAC5130C
SHA-256:	24A049C4E5C9CFF1764C312B2E0FA59A02AF235B37809180B3F2C7B2EC3DBDFD
SHA-512:	F94796A954369C4CF4058D7A522760633E73EFEBFAC4AA17869FA5783FB4E656C2D553B75A705B14D877FE069662EB96A68F97EE77F1CC61FA1775C7245F4BDA
Malicious:	false
Preview:	7126.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:bCsXlXEWtl/VlfXl:bf+yltlPl
MD5:	F5B6EE4BADABD280D5581975230D60BF
SHA1:	8287E56458E7BCDB10EF9679FE7ACBD7D05EFB02
SHA-256:	E1B4BBFE77667143503F81432D7C75B92BF0D588A5A2601C337C5C3D08C2E605
SHA-512:	37E3D81BEE3AFA6756E58403209BAFEF83F69887DF98DCCB56735D2E7DAF0841C44C0A8F326676A94029255B067DBBB31005192617E0413FFFED07197E961269
Malicious:	false
Preview:	....;...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................;.....dg........................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nMvn:u
MD5:	544A5A7E15A3E27DD3ABFC8B9282899B
SHA1:	B27F8E97F1FD4894175F1970243787609EF7400C
SHA-256:	C69AB94FA691D95F9C36E926363C9BE733455A8AF285A3EAC6A9A9853EE0D1C9
SHA-512:	BD0ACCF3EE00E445127604F3A9FA33DA8D80E35EF023D1FD2A59E46B214C9D06D119983E523CDC5E1F94EC878BCB7DDD66BC5F464879BA2DB320920FBD977095
Malicious:	false
Preview:	7129.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nGvn:4
MD5:	6489C1E07CD0133458B5F9EE1D9BAC05
SHA1:	1BBE10FB346E960456D388392AAD3C7F4FD325AA
SHA-256:	075D1FEA8444B281D25948B4D74B1A8A51B1A8AEEE5F5AB50432A33A26204FEE
SHA-512:	42E258FB1374DC08AC042A715E93CCA30396D57B92F97AF908F178029266DBE71FE879BB915788627B25AB567B420587C1EA7D87128AE071239F44583855D1B2
Malicious:	false
Preview:	7123.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.521928094887362
Encrypted:	false
SSDEEP:	3:n3uv:3g
MD5:	5034ACFEE31E60CA59A68E7ECA251E57
SHA1:	12EBEF845915E2044537FAE314CE9A03E73BEAE1
SHA-256:	AA23282EB9F62C75DB964B7E204D81FB0C955BF1F25B55D2936C65755CABBB2C
SHA-512:	238A0C7E28EB22E2031D832D62DECA63F8801A7BB91AEE4EA59A94A04C7E074077052C719C2B1D0D1AA72F8BA7A3E20EA8892410C696523AD4C6C29C91FBB0C9
Malicious:	false
Preview:	7108.7109.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nDvn:Dvn
MD5:	A1DC53A211F6E94E0BFD4FF853B9E6DF
SHA1:	8CF682295DC9A97FB9199BE46DDCC84DCAC5130C
SHA-256:	24A049C4E5C9CFF1764C312B2E0FA59A02AF235B37809180B3F2C7B2EC3DBDFD
SHA-512:	F94796A954369C4CF4058D7A522760633E73EFEBFAC4AA17869FA5783FB4E656C2D553B75A705B14D877FE069662EB96A68F97EE77F1CC61FA1775C7245F4BDA
Malicious:	false
Preview:	7126.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nMvn:u
MD5:	544A5A7E15A3E27DD3ABFC8B9282899B
SHA1:	B27F8E97F1FD4894175F1970243787609EF7400C
SHA-256:	C69AB94FA691D95F9C36E926363C9BE733455A8AF285A3EAC6A9A9853EE0D1C9
SHA-512:	BD0ACCF3EE00E445127604F3A9FA33DA8D80E35EF023D1FD2A59E46B214C9D06D119983E523CDC5E1F94EC878BCB7DDD66BC5F464879BA2DB320920FBD977095
Malicious:	false
Preview:	7129.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nGvn:4
MD5:	6489C1E07CD0133458B5F9EE1D9BAC05
SHA1:	1BBE10FB346E960456D388392AAD3C7F4FD325AA
SHA-256:	075D1FEA8444B281D25948B4D74B1A8A51B1A8AEEE5F5AB50432A33A26204FEE
SHA-512:	42E258FB1374DC08AC042A715E93CCA30396D57B92F97AF908F178029266DBE71FE879BB915788627B25AB567B420587C1EA7D87128AE071239F44583855D1B2
Malicious:	false
Preview:	7123.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.521928094887362
Encrypted:	false
SSDEEP:	3:n3uv:3g
MD5:	5034ACFEE31E60CA59A68E7ECA251E57
SHA1:	12EBEF845915E2044537FAE314CE9A03E73BEAE1
SHA-256:	AA23282EB9F62C75DB964B7E204D81FB0C955BF1F25B55D2936C65755CABBB2C
SHA-512:	238A0C7E28EB22E2031D832D62DECA63F8801A7BB91AEE4EA59A94A04C7E074077052C719C2B1D0D1AA72F8BA7A3E20EA8892410C696523AD4C6C29C91FBB0C9
Malicious:	false
Preview:	7108.7109.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nDvn:Dvn
MD5:	A1DC53A211F6E94E0BFD4FF853B9E6DF
SHA1:	8CF682295DC9A97FB9199BE46DDCC84DCAC5130C
SHA-256:	24A049C4E5C9CFF1764C312B2E0FA59A02AF235B37809180B3F2C7B2EC3DBDFD
SHA-512:	F94796A954369C4CF4058D7A522760633E73EFEBFAC4AA17869FA5783FB4E656C2D553B75A705B14D877FE069662EB96A68F97EE77F1CC61FA1775C7245F4BDA
Malicious:	false
Preview:	7126.

/tmp/qemu-open.eRKMyz (deleted)

Download File

Process:	/tmp/gnjqwpc.elf
File Type:	data
Category:	dropped
Size (bytes):	27
Entropy (8bit):	4.060262039120377
Encrypted:	false
SSDEEP:	3:TgIPhGxHJN:TgIaJN
MD5:	3CE6233A37CCF121B6A88BAD88E621BD
SHA1:	FE7EE8DFE57D8373882D61547998F23FCDCF0FFC
SHA-256:	E973BB6847117AA9ECB410974531A12FC2E2964299896EE25C25591A57204D2B
SHA-512:	5BB96EA9706354E8E1A8DA1E286C3B52BB1FF9A5DFA04CCD87CD6328804DDD853F84DC21C455739C3AE11F7A649635EC0D84AF0C6D938EE31C9FC0866BC42726
Malicious:	false
Preview:	/tmp/gnjqwpc.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.ITD6Y2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.U2XVY2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	4.935718781899191
Encrypted:	false
SSDEEP:	12:N5F5ZPaV5pMh5FnGh5FbR5FsMB5FMAvm+5FMA2+Vb5F74RF0hLad24RF5T4p1Wrm:3ZeahGt2xAvKA2+VC0pYrVoJr0rCQU
MD5:	67C621763A4A861CABF5FE31B00AA5DF
SHA1:	EAA07813AB9D8D4E548EE4FB2DEDFD6D18EF4B79
SHA-256:	D30FDA383A009DFC4848B18FD5EEDF6B73E8A59AD987D71A372D99A7B9D0E525
SHA-512:	9636E510D66B09D4A5AB08CAEA57D5E6C46332700A3E55CFC6C9AD3EEB8921F17F0490A158F7A5E124E0B82B10FFA8FCE042B0EDB7321D627504BE81E5D32B34
Malicious:	false
Preview:	Dec 19 15:24:36 galassia systemd-logind[6975]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 19 15:24:36 galassia systemd-logind[6975]: User enumeration failed: Invalid argument.Dec 19 15:24:36 galassia systemd-logind[6975]: User of session 2 not known..Dec 19 15:24:36 galassia systemd-logind[6975]: Session enumeration failed: No such file or directory.Dec 19 15:24:36 galassia systemd-logind[6975]: Watching system buttons on /dev/input/event0 (Power Button).Dec 19 15:24:36 galassia systemd-logind[6975]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 19 15:24:36 galassia systemd-logind[6975]: New seat seat0..Dec 19 15:24:51 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 19 15:24:51 galassia systemd-logind[6975]: Failed to start session scope session-c1.scope: Unit session-c1.scope already exists..Dec 19 15:24:51 galassia systemd: pam_unix(systemd-user:session):

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31Hl4vsPkbZDZl+vsPkbZDR:F3Hkfk
MD5:	9729F32CAEDA03DB06FB26A167A0E58F
SHA1:	68E44E6618DC6EB12176B66FE9B20C18EE015A81
SHA-256:	EDCEDF1F68F7E4A57444415DC9925FA625E557672801A63DE12084E8F9F6DB5E
SHA-512:	DB3EFD86554493BA0631082C8A828B9901AF98BA085F23C0BE0EAAE606B68EE8F138D73C06EEFB0E2066426A1167FAA8F17E3976EAD05BAEF62899EE516D41DE
Malicious:	false
Preview:	LPKSHHRH.................--...OT.bsf>.&l.................................--...OT.bsf>.&l........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838254
Encrypted:	false
SSDEEP:	3:F31Hl7hm//zh2/:F3s/c/
MD5:	1599AB5605109AF6F058CDBB33D78809
SHA1:	AA1A73462597601263C8F18C55E63C560CCA58F4
SHA-256:	B01657EBD0BFFDCCF323B0D10C3ABA3F88AE2492007FC8E22D027A3D59346D67
SHA-512:	40093088CB67CD3D36BDDDB86A1E25008B7E6BEC4AFEDD5FECFB5EE4654DBA0EA0512EB147EAC4D521C1F64B2B172F681AB9BEB9A5BE5261590841A3D53E9EBD
Malicious:	false
Preview:	LPKSHHRH.................U.Y.E(........................................U.Y.E(...............................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12557
Entropy (8bit):	4.957227103359094
Encrypted:	false
SSDEEP:	192:qaFqnjmdW5FiNVPTyz442r85LMT5suTjrAtQF:qaFqjmdW5FiNVPus4YnL7
MD5:	D6B4F8C35843447677BE8124CF712A9F
SHA1:	691A1E8BF5894C1E1AFC74CF076A925F24CFD82B
SHA-256:	9CAA3C44D2EBC93851F6537B17080AD29B5FF793606BE68F40C8F5EDC3BA5E1B
SHA-512:	723549D89C7CD7828E85B320C5A1FE1B9A4F0672434ABEDCC974561511E351609A4AAEC19C73B230B83DF00397C6E61AF366D284211F58AF0458EE6470D8289D
Malicious:	false
Preview:	Dec 19 15:24:26 galassia kernel: [ 569.280348] blocking signal 9: 6251 -> 658.Dec 19 15:24:26 galassia kernel: [ 569.288803] blocking signal 9: 6251 -> 720.Dec 19 15:24:26 galassia kernel: [ 569.295984] blocking signal 9: 6251 -> 772.Dec 19 15:24:26 galassia kernel: [ 569.309821] blocking signal 9: 6251 -> 936.Dec 19 15:24:26 galassia kernel: [ 569.316165] blocking signal 9: 6251 -> 2048.Dec 19 15:24:26 galassia kernel: [ 570.698103] New task spawned: old: (tgid 7037, tid 7037), new (tgid: 7037, tid: 7042).Dec 19 15:24:26 galassia kernel: [ 570.701003] New task spawned: old: (tgid 7037, tid 7037), new (tgid: 7037, tid: 7043).Dec 19 15:24:26 galassia kernel: [ 570.727532] New task spawned: old: (tgid 7037, tid 7043), new (tgid: 7037, tid: 7044).Dec 19 15:24:26 galassia kernel: [ 570.853933] New task spawned: old: (tgid 7041, tid 7041), new (tgid: 7045, tid: 7045).Dec 19 15:24:26 galassia kernel: [ 570.963785] New task spawned: old: (tgid 7045, tid 7045), new (tgid: 7046, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	34048
Entropy (8bit):	5.113856554963028
Encrypted:	false
SSDEEP:	768:pJ2eCMYeCMYeCMO5TJVtBDqY020iDnht3wQknDFVj7npB/DtUlBLCxwxcxuxq8YC:SX4q3wQQBuqcL
MD5:	B4F99710F9421FEC59D26D58A679C8A2
SHA1:	BDD50DB726D80FEE2B65C19BAFB5FB9A5EC285D5
SHA-256:	0C4F6596A8C2ECE55C8FE56229E7BE4187B3E106D69BA12B130529F9C011D456
SHA-512:	878545E3432A3499C110068AECDD533B1144050F0B76DD79370FF90BD0C8621396357A81D87D2982CA5EC0539A8B870F8810D840A370BAC73C2D0EFEBB087D64
Malicious:	false
Preview:	Dec 19 15:24:26 galassia kernel: [ 569.017673] systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 19 15:24:26 galassia kernel: [ 569.017749] systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 19 15:24:26 galassia kernel: [ 569.030731] systemd[1]: getty@tty2.service: Succeeded..Dec 19 15:24:26 galassia kernel: [ 569.032415] systemd[1]: getty@tty2.service: Scheduled restart job, restart counter is at 5..Dec 19 15:24:26 galassia kernel: [ 569.032423] systemd[1]: Stopped Getty on tty2..Dec 19 15:24:26 galassia kernel: [ 569.033059] systemd[1]: Started Getty on tty2..Dec 19 15:24:26 galassia kernel: [ 569.039164] systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 19 15:24:26 galassia kernel: [ 569.039242] systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 19 15:24:26 galassia kernel: [ 569.039721] systemd[1]: dbus.service: Main process exited, code=killed, status=9/KILL.Dec 19 15:24:26 galassia kern

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:bCsXlXEWtl/VlfXl:bf+yltlPl
MD5:	F5B6EE4BADABD280D5581975230D60BF
SHA1:	8287E56458E7BCDB10EF9679FE7ACBD7D05EFB02
SHA-256:	E1B4BBFE77667143503F81432D7C75B92BF0D588A5A2601C337C5C3D08C2E605
SHA-512:	37E3D81BEE3AFA6756E58403209BAFEF83F69887DF98DCCB56735D2E7DAF0841C44C0A8F326676A94029255B067DBBB31005192617E0413FFFED07197E961269
Malicious:	true
Preview:	....;...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................;.....dg........................................

Source: global traffic	TCP traffic: 192.168.2.23:50012 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:38186 -> 178.215.238.25:33966

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.7350415930450325
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	gnjqwpc.elf
File size:	162'760 bytes
MD5:	f226cf9654c92ae86217069d8cf6982b
SHA1:	9b935b2931e9c9eab15d65b86ebd0980ec82d94a
SHA256:	8a6abd1dca4ad174c9449a99ee954dbdcce8a4a49c54d05ab9fa597709cf1f80
SHA512:	eed4bc1f8eda8c4cbd1a830e80e0d218bed3dff7babc6cfb62850d646cb83d45c1fbef603b7c765f0ecc455efd86909865446a52f085aeff6883c7824ccc4004
SSDEEP:	1536:/4oOPWFpnBk+WpFnFK05AoIxY1DOGEZn4oX8E79xhKnrodvAVAFkum/hB4IqUeeH:/iMdD8YqIxCUZ4jE7/hvaVLkzh+Ic
TLSH:	DEF32A06730C0A47D1632EF03A3F27E093EF9AD121E4F645255FAA899172E375586ECE
File Content Preview:	.ELF...........................4..y......4. ...(........................................0...0...0...Il...X........dt.Q.............................!..\|......$H...H......$8!. \|...N.. .!..\|.......?.........zx..../...@..\?.....0D.+../...A..$8...})....0DN..

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	162240
Section Header Size:	40
Number of Section Headers:	13
Header String Table Index:	12

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	4
.text	PROGBITS	0x100000b8	0xb8	0x1f610	0x0	0x6	AX	4
.fini	PROGBITS	0x1001f6c8	0x1f6c8	0x20	0x0	0x6	AX	4
.rodata	PROGBITS	0x1001f6e8	0x1f6e8	0x33fc	0x0	0x2	A	8
.ctors	PROGBITS	0x10033000	0x23000	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x1003300c	0x2300c	0x8	0x0	0x3	WA	4
.got2	PROGBITS	0x10033018	0x23018	0xc	0x0	0x3	WA	1
.data	PROGBITS	0x10033040	0x23040	0x48a0	0x0	0x3	WA	32
.sdata	PROGBITS	0x100378e0	0x278e0	0x8c	0x0	0x3	WA	4
.sbss	NOBITS	0x1003796c	0x2796c	0x108	0x0	0x3	WA	4
.bss	NOBITS	0x10037a78	0x2796c	0x44e0	0x0	0x3	WA	8
.shstrtab	STRTAB	0x0	0x2796c	0x51	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x22ae4	0x22ae4	6.2336	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x23000	0x10033000	0x10033000	0x496c	0x8f58	0.4716	0x6	RW	0x10000	.ctors .dtors .got2 .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 19, 2024 22:22:00.079874039 CET	49751	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:00.478297949 CET	53	49751	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:00.479890108 CET	58222	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:00.614026070 CET	53	58222	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:02.004477024 CET	51517	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:02.246196032 CET	53	51517	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:02.251950979 CET	56799	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:02.651034117 CET	53	56799	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:50.342310905 CET	48217	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:50.342360973 CET	33289	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:50.464822054 CET	53	48217	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:50.464850903 CET	53	33289	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:51.560771942 CET	35145	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:51.683294058 CET	53	35145	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:54.290802002 CET	54283	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:54.693485022 CET	53	54283	8.8.8.8	192.168.2.23
Dec 19, 2024 22:22:54.700498104 CET	57661	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:22:54.834428072 CET	53	57661	8.8.8.8	192.168.2.23
Dec 19, 2024 22:23:14.198164940 CET	55178	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:23:14.320475101 CET	53	55178	8.8.8.8	192.168.2.23
Dec 19, 2024 22:23:30.381742954 CET	54832	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:23:30.381792068 CET	40509	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:23:30.504276991 CET	53	40509	8.8.8.8	192.168.2.23
Dec 19, 2024 22:23:30.515450954 CET	53	54832	8.8.8.8	192.168.2.23
Dec 19, 2024 22:24:06.484705925 CET	41562	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:24:06.619483948 CET	53	41562	8.8.8.8	192.168.2.23
Dec 19, 2024 22:24:06.620534897 CET	53979	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:24:06.757283926 CET	53	53979	8.8.8.8	192.168.2.23
Dec 19, 2024 22:24:08.146512032 CET	51695	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:24:08.281559944 CET	53	51695	8.8.8.8	192.168.2.23
Dec 19, 2024 22:24:08.282546997 CET	53429	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:24:08.404987097 CET	53	53429	8.8.8.8	192.168.2.23
Dec 19, 2024 22:24:31.304918051 CET	46047	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:24:31.305021048 CET	37776	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:24:31.427531004 CET	53	37776	8.8.8.8	192.168.2.23
Dec 19, 2024 22:24:31.438848972 CET	53	46047	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:09.903498888 CET	52112	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:10.037400007 CET	53	52112	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:10.038455963 CET	60275	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:10.172391891 CET	53	60275	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:11.608376980 CET	35536	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:11.742482901 CET	53	35536	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:11.743482113 CET	37251	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:11.877263069 CET	53	37251	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:13.265860081 CET	59681	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:13.388549089 CET	53	59681	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:13.389328003 CET	39297	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:13.523124933 CET	53	39297	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:14.965024948 CET	45597	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:15.098997116 CET	53	45597	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:15.100109100 CET	49999	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:15.234030008 CET	53	49999	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:16.621038914 CET	51970	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:16.743557930 CET	53	51970	8.8.8.8	192.168.2.23
Dec 19, 2024 22:25:16.744499922 CET	51631	53	192.168.2.23	8.8.8.8
Dec 19, 2024 22:25:16.878887892 CET	53	51631	8.8.8.8	192.168.2.23

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 19, 2024 22:23:07.327497005 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 19, 2024 22:24:27.341319084 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Bytes transferred	Direction	Data
2024-12-19 21:22:57 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-19 21:22:58 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-19 21:22:58 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-19 21:22:59 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Thu, 19 Dec 2024 21:22:58 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	21:21:58
Start date (UTC):	19/12/2024
Path:	/tmp/gnjqwpc.elf
Arguments:	/tmp/gnjqwpc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:22:01
Start date (UTC):	19/12/2024
Path:	/tmp/gnjqwpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:23:29
Start date (UTC):	19/12/2024
Path:	/tmp/gnjqwpc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Start time (UTC):	21:21:59
Start date (UTC):	19/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	21:22:00
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:40
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:43
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:45
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:46
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:47
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:48
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:49
Start date (UTC):	19/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report gnjqwpc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6943/oom_score_adj

/proc/7117/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:16217882VQYu5

/run/systemd/journal/streams/.#9:1621888ebAEI6

/run/systemd/journal/streams/.#9:1621948L67gJ6

/run/systemd/journal/streams/.#9:1621950HVHAV5

/run/systemd/journal/streams/.#9:2758590Iw7DU2

/run/systemd/journal/streams/.#9:2758638JmyX13

/run/systemd/journal/streams/.#9:2788265iLSam3

/run/systemd/journal/streams/.#9:2795096QJdeV2

/run/systemd/journal/streams/.#9:2796217PL5Gr5

/run/systemd/journal/streams/.#9:3386492R2CRp3

/run/systemd/journal/streams/.#9:430385ghHKG6

/run/systemd/journal/streams/.#9:430389mbjFh3

/run/systemd/journal/streams/.#9:430390BfWvr5

/run/systemd/journal/streams/.#9:430407Udgvj3

/run/systemd/journal/streams/.#9:4304113ctel3

/run/systemd/journal/streams/.#9:430414wN3uM3

/run/systemd/journal/streams/.#9:430499D1CYy6

/run/systemd/journal/streams/.#9:4305005Owcy3

Linux Analysis Report
gnjqwpc.elf

Start time (UTC):	21:22:50
Start date (UTC):	19/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:22:51
Start date (UTC):	19/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	21:22:52
Start date (UTC):	19/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	21:22:53
Start date (UTC):	19/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	21:22:54
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:55
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:22:57
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:23:07
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:23:09
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	21:23:08
Start date (UTC):	19/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75