Edit tour

Linux Analysis Report
byte.x86.elf

Overview

General Information

Sample name:	byte.x86.elf
Analysis ID:	1580581
MD5:	2c34b1d26adb50c974d1d390199331b6
SHA1:	827616062ac11405ebe097d44438aca19b013569
SHA256:	5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	96
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Machine Learning detection for sample

Sample is packed with UPX

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

ELF contains segments with high entropy indicating compressed/encrypted content

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample contains only a LOAD segment without any section mappings

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1580581
Start date and time:	2024-12-25 11:11:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	byte.x86.elf
Detection:	MAL
Classification:	mal96.spre.troj.evad.linELF@0/22@95/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
VT rate limit hit for: vbtgsze.r-e.kr

Process Tree

system is lnxubuntu20

byte.x86.elf (PID: 6227, Parent: 6154, MD5: 2c34b1d26adb50c974d1d390199331b6) Arguments: /tmp/byte.x86.elf

byte.x86.elf New Fork (PID: 6228, Parent: 6227)

byte.x86.elf New Fork (PID: 6229, Parent: 6227)

byte.x86.elf New Fork (PID: 6230, Parent: 6227)

byte.x86.elf New Fork (PID: 6231, Parent: 6230)

byte.x86.elf New Fork (PID: 6232, Parent: 6230)

dash New Fork (PID: 6233, Parent: 4331)

rm (PID: 6233, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.fLxwiDY4PB /tmp/tmp.hganpvdKfL /tmp/tmp.SQMDf5QAdV

dash New Fork (PID: 6234, Parent: 4331)

rm (PID: 6234, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.fLxwiDY4PB /tmp/tmp.hganpvdKfL /tmp/tmp.SQMDf5QAdV

systemd New Fork (PID: 6259, Parent: 1)

dbus-daemon (PID: 6259, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6273, Parent: 1)

rsyslogd (PID: 6273, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6274, Parent: 1860)

pulseaudio (PID: 6274, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 6275, Parent: 2038)

fusermount (PID: 6275, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6284, Parent: 1)

dbus-daemon (PID: 6284, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6285, Parent: 1860)

pulseaudio (PID: 6285, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6286, Parent: 1)

rsyslogd (PID: 6286, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6297, Parent: 1)

systemd-logind (PID: 6297, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6354, Parent: 1)

rtkit-daemon (PID: 6354, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6358, Parent: 1)

polkitd (PID: 6358, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

gdm3 New Fork (PID: 6359, Parent: 1320)

Default (PID: 6359, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6362, Parent: 1320)

Default (PID: 6362, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6363, Parent: 1320)

Default (PID: 6363, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6366, Parent: 1)

dbus-daemon (PID: 6366, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6367, Parent: 1860)

pulseaudio (PID: 6367, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6368, Parent: 1)

rsyslogd (PID: 6368, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6373, Parent: 1)

gpu-manager (PID: 6373, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6374, Parent: 6373)

sh (PID: 6374, Parent: 6373, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6376, Parent: 6374)

grep (PID: 6376, Parent: 6374, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6377, Parent: 6373)

sh (PID: 6377, Parent: 6373, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6378, Parent: 6377)

grep (PID: 6378, Parent: 6377, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6379, Parent: 6373)

sh (PID: 6379, Parent: 6373, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6380, Parent: 6379)

grep (PID: 6380, Parent: 6379, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6381, Parent: 6373)

sh (PID: 6381, Parent: 6373, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6382, Parent: 6381)

grep (PID: 6382, Parent: 6381, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6383, Parent: 6373)

sh (PID: 6383, Parent: 6373, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6384, Parent: 6383)

grep (PID: 6384, Parent: 6383, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6385, Parent: 1)

dbus-daemon (PID: 6385, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6386, Parent: 1)

generate-config (PID: 6386, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6387, Parent: 6386)

pkill (PID: 6387, Parent: 6386, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6388, Parent: 1860)

pulseaudio (PID: 6388, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6389, Parent: 1)

rsyslogd (PID: 6389, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6397, Parent: 1)

dbus-daemon (PID: 6397, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6398, Parent: 1860)

pulseaudio (PID: 6398, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6399, Parent: 1)

rsyslogd (PID: 6399, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6404, Parent: 1)

gpu-manager (PID: 6404, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6406, Parent: 6404)

sh (PID: 6406, Parent: 6404, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6407, Parent: 6406)

grep (PID: 6407, Parent: 6406, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6411, Parent: 6404)

sh (PID: 6411, Parent: 6404, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6412, Parent: 6411)

grep (PID: 6412, Parent: 6411, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6416, Parent: 6404)

sh (PID: 6416, Parent: 6404, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6417, Parent: 6416)

grep (PID: 6417, Parent: 6416, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6419, Parent: 6404)

sh (PID: 6419, Parent: 6404, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6420, Parent: 6419)

grep (PID: 6420, Parent: 6419, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6423, Parent: 6404)

systemd New Fork (PID: 6405, Parent: 1)

dbus-daemon (PID: 6405, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6408, Parent: 1860)

pulseaudio (PID: 6408, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6409, Parent: 1)

rsyslogd (PID: 6409, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6424, Parent: 1)

generate-config (PID: 6424, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6426, Parent: 6424)

pkill (PID: 6426, Parent: 6424, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6425, Parent: 1)

dbus-daemon (PID: 6425, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6427, Parent: 1860)

pulseaudio (PID: 6427, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6428, Parent: 1)

rsyslogd (PID: 6428, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6433, Parent: 1)

dbus-daemon (PID: 6433, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6435, Parent: 1860)

pulseaudio (PID: 6435, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6436, Parent: 1)

rsyslogd (PID: 6436, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6438, Parent: 1)

gpu-manager (PID: 6438, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6442, Parent: 6438)

sh (PID: 6442, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6443, Parent: 6442)

grep (PID: 6443, Parent: 6442, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6445, Parent: 6438)

sh (PID: 6445, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6446, Parent: 6445)

grep (PID: 6446, Parent: 6445, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6447, Parent: 6438)

sh (PID: 6447, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6448, Parent: 6447)

grep (PID: 6448, Parent: 6447, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6449, Parent: 6438)

sh (PID: 6449, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6450, Parent: 6449)

grep (PID: 6450, Parent: 6449, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6452, Parent: 6438)

sh (PID: 6452, Parent: 6438, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6454, Parent: 6452)

grep (PID: 6454, Parent: 6452, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 6453, Parent: 1)

rtkit-daemon (PID: 6453, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6455, Parent: 1)

dbus-daemon (PID: 6455, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6456, Parent: 1)

generate-config (PID: 6456, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6459, Parent: 6456)

pkill (PID: 6459, Parent: 6456, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6457, Parent: 1860)

pulseaudio (PID: 6457, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6458, Parent: 1)

rsyslogd (PID: 6458, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6466, Parent: 1)

gpu-manager (PID: 6466, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6467, Parent: 6466)

sh (PID: 6467, Parent: 6466, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6468, Parent: 6467)

grep (PID: 6468, Parent: 6467, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6469, Parent: 6466)

sh (PID: 6469, Parent: 6466, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6470, Parent: 6469)

grep (PID: 6470, Parent: 6469, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6471, Parent: 1)

generate-config (PID: 6471, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6472, Parent: 6471)

pkill (PID: 6472, Parent: 6471, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6473, Parent: 1)

gpu-manager (PID: 6473, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6474, Parent: 1)

generate-config (PID: 6474, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6477, Parent: 6474)

pkill (PID: 6477, Parent: 6474, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6478, Parent: 1)

gpu-manager (PID: 6478, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6479, Parent: 1)

generate-config (PID: 6479, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6480, Parent: 1)

systemd New Fork (PID: 6481, Parent: 1)

generate-config (PID: 6481, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 6482, Parent: 1)

gpu-manager (PID: 6482, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 6483, Parent: 1)

plymouth (PID: 6483, Parent: 1, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: /bin/plymouth quit

systemd New Fork (PID: 6512, Parent: 1)

systemd-logind (PID: 6512, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6589, Parent: 1)

dbus-daemon (PID: 6589, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6590, Parent: 1)

dbus-daemon (PID: 6590, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6591, Parent: 1)

systemd New Fork (PID: 6592, Parent: 1)

systemd New Fork (PID: 6593, Parent: 1)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
6232.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6232.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x11aa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x7180:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x1235:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x10db:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1d01:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1de1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1eb6:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2161:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x25e3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0xff3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x96e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x2ff2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xccab:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb5b0:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x96b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6232.1.0000000008048000.000000000805a000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xea80:$x1: POST /cdn-cgi/ 0xfdb0:$s1: LCOGQGPTGP
6227.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6227.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x11aa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x7180:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x1235:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x10db:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1d01:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1de1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1eb6:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2161:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x25e3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0xff3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x96e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x2ff2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xccab:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb5b0:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x96b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6227.1.0000000008048000.000000000805a000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xea80:$x1: POST /cdn-cgi/ 0xfdb0:$s1: LCOGQGPTGP
6229.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
6229.1.0000000008048000.000000000805a000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_fa3ad9d0	unknown	unknown	0x11aa:$a: CB 08 C1 CB 10 66 C1 CB 08 31 C9 8A 4F 14 D3 E8 01 D8 66 C1
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_b14f4c5d	unknown	unknown	0x7180:$a: 53 31 DB 8B 4C 24 0C 8B 54 24 08 83 F9 01 76 15 66 8B 02 83 E9 02 25 FF FF 00 00 83 C2 02 01 C3 83 F9 01 77 EB 49 75 05 0F BE 02 01 C3
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_93fc3657	unknown	unknown	0x1235:$a: 00 00 00 89 44 24 60 89 D1 31 C0 8B 7C 24 28 FC F3 AB 89 D1 8B 7C
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_804f8e7c	unknown	unknown	0x10db:$a: 31 ED 81 E1 FF 00 00 00 89 4C 24 58 89 EA C6 46 04 00 C1 FA 1F
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_99d78950	unknown	unknown	0x1d01:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1de1:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x1eb6:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x2161:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00 0x25e3:$a: 10 89 C3 80 BC 04 83 00 00 00 20 0F 94 C0 8D B4 24 83 00 00 00 25 FF 00
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_a68e498c	unknown	unknown	0xff3:$a: 10 39 D0 7E 25 8B 4C 24 38 01 D1 8A 11 8D 42 9F 3C 19 77 05 8D
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_88de437f	unknown	unknown	0x96e2:$a: 24 08 8B 4C 24 04 85 D2 74 0D 31 C0 89 F6 C6 04 08 00 40 39 D0
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_ae9d0fa6	unknown	unknown	0x2ff2:$a: 83 EC 04 8A 44 24 18 8B 5C 24 14 88 44 24 03 8A 44 24 10 25 FF 00
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_389ee3e9	unknown	unknown	0xccab:$a: 89 45 00 EB 2C 8B 4B 04 8B 13 8B 7B 18 8B 01 01 02 8B 02 83
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_cc93863b	unknown	unknown	0xb5b0:$a: C3 57 8B 44 24 0C 8B 4C 24 10 8B 7C 24 08 F3 AA 8B 44 24 08
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Linux_Trojan_Mirai_8aa7b5d3	unknown	unknown	0x96b2:$a: 8B 4C 24 14 8B 74 24 0C 8B 5C 24 10 85 C9 74 0D 31 D2 8A 04 1A 88
6229.1.0000000008048000.000000000805a000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0xea80:$x1: POST /cdn-cgi/ 0xfdb0:$s1: LCOGQGPTGP
Process Memory Space: byte.x86.elf PID: 6227	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.x86.elf PID: 6227	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.x86.elf PID: 6229	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.x86.elf PID: 6229	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.x86.elf PID: 6232	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.x86.elf PID: 6232	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 43 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: byte.x86.elf

ReversingLabs: Detection: 42%

Machine Learning detection for sample

Source: byte.x86.elf

Joe Sandbox ML: detected

Source: /usr/bin/pkill (PID: 6387)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6426)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6459)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6477)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: global traffic

TCP traffic: 192.168.2.23:43548 -> 154.216.19.138:777

Source: /usr/sbin/rsyslogd (PID: 6273)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6286)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6389)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6399)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6409)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6428)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6458)	Reads hosts file: /etc/hosts	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: vbtgsze.r-e.kr
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: byte.x86.elf	String found in binary or memory: http://upx.sf.net
Source: syslog.146.dr, syslog.57.dr, syslog.27.dr, syslog.138.dr, syslog.112.dr, syslog.37.dr, syslog.97.dr, syslog.178.dr, syslog.91.dr	String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 Author: unknown
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth

Sample tries to kill a massive number of system processes

Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4482, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6287, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6366, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6367, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6373, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6385, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6388, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6389, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6390, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6404, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6408, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6433, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6435, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6437, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6438, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4482, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6397, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6398, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6399, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6400, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6424, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6427, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6428, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6429, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6455, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6457, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6462, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6473, result: successful	Jump to behavior

Source: LOAD without section mappings

Program segment: 0x8048000

Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4482, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6273, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6284, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6285, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6287, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6366, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6367, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6368, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6369, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6373, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6385, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6386, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6388, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6389, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6390, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6404, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6405, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6408, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6409, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6410, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6433, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6435, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6436, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6437, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6438, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6228)	SIGKILL sent: pid: 6471, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1320, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1601, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4482, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 4486, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6397, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6398, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6399, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6400, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6424, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6425, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6427, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6428, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6429, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6455, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6456, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6457, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6462, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6466, result: successful	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	SIGKILL sent: pid: 6473, result: successful	Jump to behavior

Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_fa3ad9d0 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = fe93a3552b72b107f95cc5a7e59da64fe84d31df833bf36c81d8f31d8d79d7ca, id = fa3ad9d0-7c55-4621-90fc-6b154c44a67b, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_b14f4c5d os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = a70d052918dd2fbc66db241da6438015130f0fb6929229bfe573546fe98da817, id = b14f4c5d-054f-46e6-9fa8-3588f1ef68b7, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_93fc3657 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = d01a9e85a01fad913ca048b60bda1e5a2762f534e5308132c1d3098ac3f561ee, id = 93fc3657-fd21-4e93-a728-c084fc0a6a4a, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_804f8e7c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 1080d8502848d532a0b38861437485d98a41d945acaf3cb676a7a2a2f6793ac6, id = 804f8e7c-4786-42bc-92e4-c68c24ca530e, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_99d78950 reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 3008edc4e7a099b64139a77d15ec0e2c3c1b55fc23ab156304571c4d14bc654c, id = 99d78950-ea23-4166-a85a-7a029209f5b1, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_a68e498c reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 951c9dfcba531e5112c872395f6c144c4bc8b71c666d2c7d9d8574a23c163883, id = a68e498c-0768-4321-ab65-42dd6ef85323, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_88de437f reference_sample = 8dc745a6de6f319cd6021c3e147597315cc1be02099d78fc8aae94de0e1e4bc6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = c19eb595c2b444a809bef8500c20342c9f46694d3018e268833f9b884133a1ea, id = 88de437f-9c98-4e1d-96c0-7b433c99886a, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_ae9d0fa6 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = ca2bf2771844bec95563800d19a35dd230413f8eff0bd44c8ab0b4c596f81bfc, id = ae9d0fa6-be06-4656-9b13-8edfc0ee9e71, last_modified = 2021-09-16
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_389ee3e9 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 59f2359dc1f41d385d639d157b4cd9fc73d76d8abb7cc09d47632bb4c9a39e6e, id = 389ee3e9-70c1-4c93-a999-292cf6ff1652, last_modified = 2022-01-26
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_cc93863b reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = f3ecd30f0b511a8e92cfa642409d559e7612c3f57a1659ca46c77aca809a00ac, id = cc93863b-1050-40ba-9d02-5ec9ce6a3a28, last_modified = 2022-01-26
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Mirai_8aa7b5d3 reference_sample = 5217f2a46cb93946e04ab00e385ad0fe0a2844b6ea04ef75ee9187aac3f3d52f, os = linux, severity = x86, creation_date = 2022-01-05, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Mirai, fingerprint = 02a2c18c362df4b1fceb33f3b605586514ba9a00c7afedf71c04fa54d8146444, id = 8aa7b5d3-e1eb-4b55-b36a-0d3a242c06e9, last_modified = 2022-01-26
Source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b

Source: classification engine

Classification label: mal96.spre.troj.evad.linELF@0/22@95/0

Data Obfuscation

Sample is packed with UPX

Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Info: This file is packed with the UPX executable packer http://upx.sf.net $
Source: initial sample	String containing UPX found: $Id: UPX 3.96 Copyright (C) 1996-2020 the UPX Team. All Rights Reserved. $

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6259)	File: /proc/6259/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6275)	File: /proc/6275/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File: /proc/6284/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6366)	File: /proc/6366/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6385)	File: /proc/6385/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6397)	File: /proc/6397/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6405)	File: /proc/6405/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6425)	File: /proc/6425/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6433)	File: /proc/6433/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6455)	File: /proc/6455/mounts	Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 6297)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6297)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6297)	File: /run/systemd/seats/.#seat0Jp6Pal	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6512)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6512)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6512)	File: /run/systemd/seats/.#seat0hDXvAD	Jump to behavior

Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/22/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/22/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/23/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/23/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/24/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/24/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/25/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/25/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/9/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/9/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/20/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/20/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/21/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/21/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/6285/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/6284/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/6284/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/6287/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/6354/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6284)	File opened: /proc/1389/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6354/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6468/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6228/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6241/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6240/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6243/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6242/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6363/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6366/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6244/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6247/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6368/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/6367/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/byte.x86.elf (PID: 6231)	File opened: /proc/1/cmdline	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6374)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6377)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6379)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6381)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6383)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6406)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6411)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6416)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6419)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6442)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6445)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6447)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6449)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6452)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6467)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6469)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior

Source: /bin/sh (PID: 6376)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6378)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6380)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6382)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6384)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6407)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6412)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6417)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6420)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6443)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6446)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6448)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6450)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6454)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6468)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6470)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 6387)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6426)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6459)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6472)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6477)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Source: /usr/bin/dash (PID: 6233)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.fLxwiDY4PB /tmp/tmp.hganpvdKfL /tmp/tmp.SQMDf5QAdV			Jump to behavior
Source: /usr/bin/dash (PID: 6234)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.fLxwiDY4PB /tmp/tmp.hganpvdKfL /tmp/tmp.SQMDf5QAdV			Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6273)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6286)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6286)	Log file created: /var/log/auth.log
Source: /usr/sbin/rsyslogd (PID: 6368)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6368)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6389)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6399)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6409)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6428)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6436)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6458)	Log file created: /var/log/kern.log	Jump to dropped file

Source: byte.x86.elf

Submission file: segment LOAD with 7.8776 entropy (max. 8.0)

Source: /usr/bin/gpu-manager (PID: 6373)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6404)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6438)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6466)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: /usr/bin/pkill (PID: 6387)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6426)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6459)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6472)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6477)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6273)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6286)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6368)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6389)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6399)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6409)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6428)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6436)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6458)	Queries kernel information via 'uname':	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6232, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6232, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6232, type: MEMORYSTR

Yara detected Okiru

Source: Yara match	File source: 6232.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6227.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6229.1.0000000008048000.000000000805a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6227, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6229, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.x86.elf PID: 6232, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 File Deletion	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
byte.x86.elf	42%	ReversingLabs	Linux.Trojan.Mirai
byte.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
daisy.ubuntu.com	162.213.35.24	true	false		high
vbtgsze.r-e.kr	154.216.19.138	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.146.dr, syslog.57.dr, syslog.27.dr, syslog.138.dr, syslog.112.dr, syslog.37.dr, syslog.97.dr, syslog.178.dr, syslog.91.dr	false		high
http://upx.sf.net	byte.x86.elf	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
154.216.19.138	vbtgsze.r-e.kr	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
54.171.230.55	armv4eb.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Mirai	Browse
	zmap.mpsl.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse
	nsharm5.elf	Get hash	malicious	Unknown	Browse
	sh4.nn.elf	Get hash	malicious	Okiru	Browse
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse
	zerarm6.elf	Get hash	malicious	Unknown	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	hidakibest.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse
154.216.19.138	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	armv4eb.elf	Get hash	malicious	Unknown	Browse
	armv5l.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Mirai	Browse
	most-arm7.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	armv4eb.elf	Get hash	malicious	Unknown	Browse
	armv5l.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Unknown	Browse
	sshd.elf	Get hash	malicious	Unknown	Browse
	armv4eb.elf	Get hash	malicious	Mirai	Browse
	most-arm7.elf	Get hash	malicious	Mirai	Browse
	arm5.elf	Get hash	malicious	Unknown	Browse
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse
	x86.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	armv7l.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	armv4l.elf	Get hash	malicious	Unknown	Browse	162.213.35.24
	loligang.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	loligang.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	arm.nn-20241224-0652.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	x86_64.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
	m68k.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.24
	x86_32.nn.elf	Get hash	malicious	Okiru	Browse	162.213.35.25
vbtgsze.r-e.kr	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	154.216.19.138

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	armv4eb.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv5l.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	armv4eb.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	sshd.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	loligang.arm5.elf	Get hash	malicious	Mirai	Browse	185.125.190.26
	armv4eb.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-arm7.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	91.189.91.42
AMAZON-02US	armv4l.elf	Get hash	malicious	Unknown	Browse	52.221.127.63
	armv4eb.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	telnet.x86.elf	Get hash	malicious	Unknown	Browse	54.154.23.188
	https://email.equifaxbreachsettlement.com/c/eJwUys9qtDAQAPCnSY6STLL_DjnIp4GFr-3iLrX0EuLMiMLqWo1r-_al9x-5yDrGo2SnD8YednvYK9m5lhEPSJpaYtPgDk-NUUQKCS3r2MjegQKrAbSy1oLKWmC1UycbkU9asxZW8dfat_G7mTlit3BKdx54TBk-Bnl3XUrTIkwuwAvw27Zlw8808xR7Qh4Tz39OgJ-ZmAdhPOODWJiihuP7y__al5_1Vc5uoPhMfRyFVeuCGdMqkyv9R7hUb6HKb3m4VOUlPxfhX14VoThfb-Favhby6eA3AAD__0qSUF8	Get hash	malicious	Unknown	Browse	18.221.139.220
	http://assets.website-files.com/65efffe8d4e10d26910f0543/65f65633ab8b2f021b357c18_64146967722.pdf	Get hash	malicious	Unknown	Browse	52.211.121.244
	armv5l.elf	Get hash	malicious	Mirai	Browse	52.11.1.37
	armv6l.elf	Get hash	malicious	Mirai	Browse	13.210.214.39
	loligang.mpsl.elf	Get hash	malicious	Mirai	Browse	65.1.40.160
	loligang.arm.elf	Get hash	malicious	Mirai	Browse	13.243.198.228
	loligang.x86.elf	Get hash	malicious	Mirai	Browse	34.213.27.51
SKHT-ASShenzhenKatherineHengTechnologyInformationCo	zerarm7.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	nabm68k.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabarm.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	zerppc.elf	Get hash	malicious	Unknown	Browse	154.216.16.250
	zerarm5.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabx86.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabsh4.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabmpsl.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	nabmips.elf	Get hash	malicious	Unknown	Browse	154.216.16.244
	arm.elf	Get hash	malicious	Unknown	Browse	45.207.239.67
INIT7CH	armv4eb.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv5l.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	sshd.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	armv4eb.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	most-arm7.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	zmap.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	zmap.sh4.elf	Get hash	malicious	Mirai, Okiru	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/run/systemd/seats/.#seat0Jp6Pal

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0hDXvAD

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	547
Entropy (8bit):	4.920580537655956
Encrypted:	false
SSDEEP:	12:kaWFMNAaWFMN4aWFHMwaWFNAvmVaWFNA2+ViaWFa7:vbjbbs8MAvLMA2+Vtt
MD5:	D9B5F670603C7DA13201DD7DDAC67C5E
SHA1:	3F92A6BC7DF0685964ACC8A0ED2470A015A856C4
SHA-256:	45D714A568D5B64462A934BC730FB73F25EFA9DA36AF08B82643BD96485EF6F9
SHA-512:	053B6F3FD9FAA6D9D2185EBC4DBB1E544F714394B1832CC199D63E65B5CA1F135578DAF4F8178A7BEA4598493ED7124C41C14BED0F090B6E7A75EF7B4E786E9C
Malicious:	false
Reputation:	low
Preview:	Dec 25 04:11:52 galassia systemd-logind[6297]: User of session 2 not known..Dec 25 04:11:52 galassia systemd-logind[6297]: User of session c1 not known..Dec 25 04:11:52 galassia systemd-logind[6297]: Session enumeration failed: No such file or directory.Dec 25 04:11:52 galassia systemd-logind[6297]: Watching system buttons on /dev/input/event0 (Power Button).Dec 25 04:11:52 galassia systemd-logind[6297]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 25 04:11:52 galassia systemd-logind[6297]: New seat seat0..

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	962
Entropy (8bit):	4.7796270827132386
Encrypted:	false
SSDEEP:	24:NLAIm5gawVvn3AIXsMT1ezp5yytfl5QAIkTJqBmAIkTJB:Nlm+Z/ZXlT1uwyZl5OkToOkTn
MD5:	E61C6B10FDF6620D66B85E8769B45518
SHA1:	505F349C0687A22493B30A5F6CFF718BC61CCD41
SHA-256:	77899D0ABC6043EFD84B426D7A7CB0EE05E0FA663897CA548F702B05E7C75F5D
SHA-512:	922BFBE2404BACA1D7614FD92A663C7D317801BF1E7764399CBDDB09BCA30AEF55A67A2C1C1B4F0769190E1CCDF3FC65D511598AD14AE16B648FB0207D9174DE
Malicious:	false
Reputation:	low
Preview:	Dec 25 04:12:08 galassia kernel: [ 433.747789] New task spawned: old: (tgid 6452, tid 6452), new (tgid: 6454, tid: 6454).Dec 25 04:12:08 galassia kernel: [ 433.891497] blocking signal 9: 6231 -> 720.Dec 25 04:12:08 galassia kernel: [ 433.983818] blocking signal 9: 6231 -> 772.Dec 25 04:12:08 galassia kernel: [ 434.029042] New task spawned: old: (tgid 6456, tid 6456), new (tgid: 6459, tid: 6459).Dec 25 04:12:08 galassia kernel: [ 434.049921] blocking signal 9: 6228 -> 1.Dec 25 04:12:08 galassia kernel: [ 434.061031] blocking signal 9: 6231 -> 936.Dec 25 04:12:08 galassia kernel: [ 434.137054] blocking signal 9: 6231 -> 1601.Dec 25 04:12:08 galassia kernel: [ 434.213101] blocking signal 9: 6231 -> 2048.Dec 25 04:12:08 galassia kernel: [ 434.736888] New task spawned: old: (tgid 6458, tid 6458), new (tgid: 6458, tid: 6463).Dec 25 04:12:08 galassia kernel: [ 434.738824] New task spawned: old: (tgid 6458, tid 6458), new (tgid: 6458, tid: 6464).

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5322
Entropy (8bit):	5.050047927197951
Encrypted:	false
SSDEEP:	48:u36Iiz1k0vZzq3PVRUmVgVKVHfJjlm+Z/ZXlT1uwyZl5OkToOkTAo3nkEJfL0wIZ:TqfVRUmqcdyeVdL0wIY5E4MMk
MD5:	A3A506A486B08C3D2C0B69C45EDC6040
SHA1:	21CCA0D416B683B4A7A0B326D5F3F923A97BA802
SHA-256:	2242389BE2A793F7F6FE5AED26C955FDBAA18010255EDB82AAF3A9509A47EE84
SHA-512:	F4C00832E98F75BA561515BDA735DC1C198F6332500ED5019E3667B64E074159EE89A4804B8F94EB5BE3D72A043E5A99471FFBBAEAF36DD61E071BF0217E766E
Malicious:	false
Reputation:	low
Preview:	Dec 25 04:12:07 galassia systemd[1]: rsyslog.service: Main process exited, code=killed, status=9/KILL.Dec 25 04:12:07 galassia systemd[1]: rsyslog.service: Failed with result 'signal'..Dec 25 04:12:07 galassia systemd[1]: whoopsie.service: Main process exited, code=killed, status=9/KILL.Dec 25 04:12:07 galassia systemd[1]: whoopsie.service: Failed with result 'signal'..Dec 25 04:12:07 galassia systemd[1]: gpu-manager.service: Main process exited, code=killed, status=9/KILL.Dec 25 04:12:07 galassia systemd[1]: gpu-manager.service: Failed with result 'signal'..Dec 25 04:12:07 galassia systemd[1]: Failed to start Detect the available GPUs and deal with any system changes..Dec 25 04:12:07 galassia systemd[1]: Starting GNOME Display Manager....Dec 25 04:12:07 galassia systemd[1860]: pulseaudio.service: Scheduled restart job, restart counter is at 9..Dec 25 04:12:07 galassia systemd[1860]: Stopped Sound Service..Dec 25 04:12:07 galassia systemd[1860]: Starting Sound Service....Dec 25 04:12:0

Static File Info

General

File type:	ELF 32-bit LSB executable, Intel 80386, version 1 (GNU/Linux), statically linked, no section header
Entropy (8bit):	7.874339709302536
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 50.16% ELF Executable and Linkable format (generic) (4004/1) 49.84%
File name:	byte.x86.elf
File size:	40'108 bytes
MD5:	2c34b1d26adb50c974d1d390199331b6
SHA1:	827616062ac11405ebe097d44438aca19b013569
SHA256:	5eacaa1cdd540e88cd6cc9e21f1d00af5aa564821103806302b98fe132e7855e
SHA512:	3d4101885f85846e2eab8927c8c8fcf8cd34410e5f7670a0a12f63a6e6c41a054ff22d7f96cdc68889bf1cc52ee541282a3f80a1dd71efc6247c59fde2b10e58
SSDEEP:	768:oCvR44PLfnqsB4UzbYuC4BNeF0Y6722iEZiLwp1VuSorn3NLJIy:oi3P7n7B4UzyFR6CfEcsVujrD7
TLSH:	D703F1D022EE3B92D0ED62FD07A7264415240577439F272F8A941B8A26E04ECD7F5BCB
File Content Preview:	.ELF........................4...........4. ...(.............................................. ... ..................Q.td...............................7UPX!........P%..P%......c........?d..ELF.......d...m...4..#.. .(.....~m..-.#........................m..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Intel 80386
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - Linux
ABI Version:	0
Entry Point Address:	0x80512b0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	0
Section Header Size:	40
Number of Section Headers:	0
Header String Table Index:	0

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align
LOAD	0x0	0x8048000	0x8048000	0x9b9c	0x9b9c	7.8776	0x5	R E	0x1000
LOAD	0x0	0x8052000	0x8052000	0x0	0xbb80	0.0000	0x6	RW	0x1000
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 11:11:48.134587049 CET	443	33606	54.171.230.55	192.168.2.23
Dec 25, 2024 11:11:48.134752989 CET	33606	443	192.168.2.23	54.171.230.55
Dec 25, 2024 11:11:48.230173111 CET	43548	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:48.254349947 CET	443	33606	54.171.230.55	192.168.2.23
Dec 25, 2024 11:11:48.349706888 CET	777	43548	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:48.349771023 CET	43548	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:48.349822044 CET	43548	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:48.469394922 CET	777	43548	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:48.469477892 CET	43548	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:48.589345932 CET	777	43548	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:49.409706116 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 11:11:49.648585081 CET	777	43548	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:49.648693085 CET	43548	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:49.648694038 CET	43548	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:50.506086111 CET	43552	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:50.625894070 CET	777	43552	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:50.626017094 CET	43552	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:50.626018047 CET	43552	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:50.745650053 CET	777	43552	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:50.745743036 CET	43552	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:50.865308046 CET	777	43552	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:51.929408073 CET	777	43552	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:51.929471016 CET	43552	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:51.929531097 CET	43552	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:52.063935995 CET	43554	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:52.183600903 CET	777	43554	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:52.183728933 CET	43554	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:52.183728933 CET	43554	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:52.303308964 CET	777	43554	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:52.303397894 CET	43554	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:52.423077106 CET	777	43554	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:53.483908892 CET	777	43554	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:53.483982086 CET	43554	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:53.483983040 CET	43554	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:53.619180918 CET	43556	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:53.738677025 CET	777	43556	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:53.738792896 CET	43556	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:53.738792896 CET	43556	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:53.861371040 CET	777	43556	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:53.861412048 CET	43556	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:53.980859041 CET	777	43556	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:55.038752079 CET	777	43556	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:55.038826942 CET	43556	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:55.038826942 CET	43556	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:55.044945955 CET	42836	443	192.168.2.23	91.189.91.43
Dec 25, 2024 11:11:56.001210928 CET	43558	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:56.068751097 CET	42516	80	192.168.2.23	109.202.202.202
Dec 25, 2024 11:11:56.120949984 CET	777	43558	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:56.120994091 CET	43558	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:56.121041059 CET	43558	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:56.240552902 CET	777	43558	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:56.240593910 CET	43558	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:56.360162973 CET	777	43558	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:57.420883894 CET	777	43558	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:57.420933962 CET	43558	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:57.420958996 CET	43558	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:57.554769993 CET	43560	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:57.674354076 CET	777	43560	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:57.674422979 CET	43560	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:57.674422979 CET	43560	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:57.793965101 CET	777	43560	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:57.794022083 CET	43560	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:57.913517952 CET	777	43560	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:58.971926928 CET	777	43560	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:58.971996069 CET	43560	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:58.971996069 CET	43560	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:59.106266022 CET	43562	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:59.225810051 CET	777	43562	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:59.225887060 CET	43562	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:59.225887060 CET	43562	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:59.345614910 CET	777	43562	154.216.19.138	192.168.2.23
Dec 25, 2024 11:11:59.345654011 CET	43562	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:11:59.465214014 CET	777	43562	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:00.524936914 CET	777	43562	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:00.525008917 CET	43562	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:00.525034904 CET	43562	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:00.658768892 CET	43564	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:00.778331995 CET	777	43564	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:00.779252052 CET	43564	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:00.779299021 CET	43564	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:00.898830891 CET	777	43564	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:00.898893118 CET	43564	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:01.018361092 CET	777	43564	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:02.078670025 CET	777	43564	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:02.078741074 CET	43564	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:02.078840971 CET	43564	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:02.773958921 CET	43566	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:02.895849943 CET	777	43566	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:02.895910025 CET	43566	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:02.895977974 CET	43566	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:03.015975952 CET	777	43566	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:03.016031027 CET	43566	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:03.135504007 CET	777	43566	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:04.194432020 CET	777	43566	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:04.194511890 CET	43566	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:04.194614887 CET	43566	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:05.143281937 CET	43568	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:05.262988091 CET	777	43568	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:05.263048887 CET	43568	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:05.263079882 CET	43568	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:05.383599997 CET	777	43568	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:05.383662939 CET	43568	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:05.503273964 CET	777	43568	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:06.563009024 CET	777	43568	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:06.563092947 CET	43568	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:06.563092947 CET	43568	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:06.685851097 CET	43570	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:06.805470943 CET	777	43570	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:06.805581093 CET	43570	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:06.805608988 CET	43570	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:06.925088882 CET	777	43570	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:06.925151110 CET	43570	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:07.045326948 CET	777	43570	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:08.105684042 CET	777	43570	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:08.105772018 CET	43570	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:08.105772018 CET	43570	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:08.239696026 CET	43572	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:08.359287977 CET	777	43572	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:08.359359980 CET	43572	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:08.359406948 CET	43572	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:08.478862047 CET	777	43572	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:08.478912115 CET	43572	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:08.598448992 CET	777	43572	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:09.374901056 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 11:12:09.672611952 CET	777	43572	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:09.672700882 CET	43572	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:09.672700882 CET	43572	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:09.806638002 CET	43574	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:09.926208019 CET	777	43574	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:09.926280022 CET	43574	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:09.926326990 CET	43574	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:10.046015978 CET	777	43574	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:10.046070099 CET	43574	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:10.165579081 CET	777	43574	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:11.223835945 CET	777	43574	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:11.223933935 CET	43574	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:11.223934889 CET	43574	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:11.358592033 CET	43576	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:11.478101015 CET	777	43576	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:11.478183985 CET	43576	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:11.478259087 CET	43576	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:11.598826885 CET	777	43576	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:11.598884106 CET	43576	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:11.718360901 CET	777	43576	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:12.780754089 CET	777	43576	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:12.780846119 CET	43576	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:12.780846119 CET	43576	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:12.915050030 CET	43578	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:13.034540892 CET	777	43578	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:13.034619093 CET	43578	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:13.034619093 CET	43578	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:13.154124022 CET	777	43578	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:13.154181957 CET	43578	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:13.273758888 CET	777	43578	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:14.334769011 CET	777	43578	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:14.334861994 CET	43578	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:14.334861994 CET	43578	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:14.469063997 CET	43580	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:14.588635921 CET	777	43580	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:14.588711023 CET	43580	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:14.588722944 CET	43580	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:14.708338022 CET	777	43580	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:14.708395004 CET	43580	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:14.827980042 CET	777	43580	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:15.889086008 CET	777	43580	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:15.889169931 CET	43580	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:15.889169931 CET	43580	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:16.023087978 CET	43582	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:16.142877102 CET	777	43582	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:16.142961025 CET	43582	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:16.142961025 CET	43582	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:16.262721062 CET	777	43582	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:16.262780905 CET	43582	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:16.382440090 CET	777	43582	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:17.443170071 CET	777	43582	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:17.443257093 CET	43582	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:17.443258047 CET	43582	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:18.338826895 CET	43584	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:18.458359003 CET	777	43584	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:18.458451033 CET	43584	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:18.458451033 CET	43584	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:18.578036070 CET	777	43584	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:18.578082085 CET	43584	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:18.697650909 CET	777	43584	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:19.756104946 CET	777	43584	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:19.756153107 CET	43584	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:19.756215096 CET	43584	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:19.890073061 CET	43586	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:20.009562969 CET	777	43586	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:20.009612083 CET	43586	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:20.009645939 CET	43586	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:20.129137993 CET	777	43586	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:20.129179001 CET	43586	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:20.248696089 CET	777	43586	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:21.309344053 CET	777	43586	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:21.309422016 CET	43586	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:21.309422016 CET	43586	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:21.443303108 CET	43588	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:21.562829971 CET	777	43588	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:21.562880993 CET	43588	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:21.562897921 CET	43588	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:21.661171913 CET	42836	443	192.168.2.23	91.189.91.43
Dec 25, 2024 11:12:21.682462931 CET	777	43588	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:21.682506084 CET	43588	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:21.802072048 CET	777	43588	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:22.861829996 CET	777	43588	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:22.861880064 CET	43588	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:22.861897945 CET	43588	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:23.585398912 CET	43590	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:23.705419064 CET	777	43590	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:23.705502033 CET	43590	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:23.705530882 CET	43590	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:23.825486898 CET	777	43590	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:23.825540066 CET	43590	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:23.945231915 CET	777	43590	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:25.006092072 CET	777	43590	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:25.008150101 CET	43590	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:25.008208036 CET	43590	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:25.150430918 CET	43592	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:25.270081997 CET	777	43592	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:25.270134926 CET	43592	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:25.270164967 CET	43592	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:25.389758110 CET	777	43592	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:25.391011953 CET	43592	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:25.510602951 CET	777	43592	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:25.756592989 CET	42516	80	192.168.2.23	109.202.202.202
Dec 25, 2024 11:12:26.682610035 CET	777	43592	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:26.682682037 CET	43592	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:26.803399086 CET	777	43592	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:27.817966938 CET	43594	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:27.937644005 CET	777	43594	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:27.937701941 CET	43594	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:27.937728882 CET	43594	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:28.057248116 CET	777	43594	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:28.057306051 CET	43594	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:28.176907063 CET	777	43594	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:29.239903927 CET	777	43594	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:29.239969969 CET	43594	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:29.240004063 CET	43594	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:29.374075890 CET	43596	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:29.493649006 CET	777	43596	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:29.493709087 CET	43596	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:29.493740082 CET	43596	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:29.613251925 CET	777	43596	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:29.613306046 CET	43596	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:29.732877970 CET	777	43596	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:30.799441099 CET	777	43596	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:30.799499989 CET	43596	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:30.799516916 CET	43596	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:30.933732033 CET	43598	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:31.053395987 CET	777	43598	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:31.053452969 CET	43598	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:31.053479910 CET	43598	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:31.173058033 CET	777	43598	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:31.173099995 CET	43598	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:31.292640924 CET	777	43598	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:32.352906942 CET	777	43598	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:32.352971077 CET	43598	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:32.352997065 CET	43598	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:32.475758076 CET	43600	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:32.595442057 CET	777	43600	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:32.595510006 CET	43600	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:32.595561981 CET	43600	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:32.715574026 CET	777	43600	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:32.715639114 CET	43600	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:32.835439920 CET	777	43600	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:33.898684025 CET	777	43600	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:33.898758888 CET	43600	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:33.898758888 CET	43600	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:34.033046007 CET	43602	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:34.154146910 CET	777	43602	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:34.154208899 CET	43602	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:34.154253960 CET	43602	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:34.273941040 CET	777	43602	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:34.273998976 CET	43602	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:34.393526077 CET	777	43602	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:35.452075005 CET	777	43602	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:35.452146053 CET	43602	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:35.452147007 CET	43602	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:35.586165905 CET	43604	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:35.705859900 CET	777	43604	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:35.705934048 CET	43604	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:35.705986977 CET	43604	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:35.825647116 CET	777	43604	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:35.825707912 CET	43604	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:35.945300102 CET	777	43604	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:37.002521038 CET	777	43604	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:37.002614021 CET	43604	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:37.002614021 CET	43604	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:37.136995077 CET	43606	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:37.256597996 CET	777	43606	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:37.256675959 CET	43606	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:37.256719112 CET	43606	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:37.376290083 CET	777	43606	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:37.376342058 CET	43606	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:37.495903969 CET	777	43606	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:38.556135893 CET	777	43606	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:38.556214094 CET	43606	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:38.556214094 CET	43606	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:38.690505981 CET	43608	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:38.810228109 CET	777	43608	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:38.810278893 CET	43608	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:38.810302019 CET	43608	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:38.930110931 CET	777	43608	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:38.930176020 CET	43608	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:39.049918890 CET	777	43608	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:40.112704992 CET	777	43608	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:40.112767935 CET	43608	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:40.112793922 CET	43608	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:40.235372066 CET	43610	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:40.355068922 CET	777	43610	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:40.355130911 CET	43610	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:40.355156898 CET	43610	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:40.474760056 CET	777	43610	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:40.474813938 CET	43610	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:40.594656944 CET	777	43610	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:41.654911995 CET	777	43610	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:41.654969931 CET	43610	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:41.654989958 CET	43610	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:41.790040016 CET	43612	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:41.909703016 CET	777	43612	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:41.909769058 CET	43612	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:41.909817934 CET	43612	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:42.029395103 CET	777	43612	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:42.029449940 CET	43612	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:42.149010897 CET	777	43612	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:43.209623098 CET	777	43612	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:43.209691048 CET	43612	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:43.209691048 CET	43612	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:43.344393015 CET	43614	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:43.464179993 CET	777	43614	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:43.464270115 CET	43614	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:43.464271069 CET	43614	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:43.583971977 CET	777	43614	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:43.584032059 CET	43614	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:43.703677893 CET	777	43614	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:44.765796900 CET	777	43614	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:44.765898943 CET	43614	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:44.765898943 CET	43614	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:44.900444984 CET	43616	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:45.020128012 CET	777	43616	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:45.020207882 CET	43616	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:45.020261049 CET	43616	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:45.139959097 CET	777	43616	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:45.140036106 CET	43616	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:45.259751081 CET	777	43616	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:46.318594933 CET	777	43616	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:46.318671942 CET	43616	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:46.318671942 CET	43616	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:46.453869104 CET	43618	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:46.573545933 CET	777	43618	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:46.573642015 CET	43618	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:46.573642015 CET	43618	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:46.693305969 CET	777	43618	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:46.693362951 CET	43618	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:46.813033104 CET	777	43618	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:47.875226974 CET	777	43618	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:47.875308990 CET	43618	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:47.875308990 CET	43618	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:48.009519100 CET	43620	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:48.129288912 CET	777	43620	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:48.129352093 CET	43620	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:48.129400969 CET	43620	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:48.249026060 CET	777	43620	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:48.249102116 CET	43620	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:48.368662119 CET	777	43620	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:49.428931952 CET	777	43620	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:49.429012060 CET	43620	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:49.429012060 CET	43620	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:49.562824965 CET	43622	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:49.682636976 CET	777	43622	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:49.682706118 CET	43622	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:49.682743073 CET	43622	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:49.802383900 CET	777	43622	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:49.802443981 CET	43622	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:49.922131062 CET	777	43622	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:50.329150915 CET	43928	443	192.168.2.23	91.189.91.42
Dec 25, 2024 11:12:50.981254101 CET	777	43622	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:50.981317043 CET	43622	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:50.981357098 CET	43622	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:51.104123116 CET	43624	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:51.223716974 CET	777	43624	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:51.223778009 CET	43624	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:51.223804951 CET	43624	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:51.343455076 CET	777	43624	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:51.343502998 CET	43624	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:51.463305950 CET	777	43624	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:52.523516893 CET	777	43624	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:52.523590088 CET	43624	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:52.523612022 CET	43624	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:52.658016920 CET	43626	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:52.777596951 CET	777	43626	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:52.777663946 CET	43626	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:52.777678013 CET	43626	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:52.897476912 CET	777	43626	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:52.897531033 CET	43626	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:53.017129898 CET	777	43626	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:54.080981016 CET	777	43626	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:54.081034899 CET	43626	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:54.081056118 CET	43626	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:54.220182896 CET	43628	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:54.339813948 CET	777	43628	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:54.339886904 CET	43628	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:54.339950085 CET	43628	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:54.459505081 CET	777	43628	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:54.459569931 CET	43628	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:54.579535007 CET	777	43628	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:55.641607046 CET	777	43628	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:55.641709089 CET	43628	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:55.641709089 CET	43628	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:55.764342070 CET	43630	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:55.884054899 CET	777	43630	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:55.884119034 CET	43630	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:55.884155035 CET	43630	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:56.003762960 CET	777	43630	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:56.003830910 CET	43630	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:56.123397112 CET	777	43630	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:57.184580088 CET	777	43630	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:57.184659958 CET	43630	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:57.184659958 CET	43630	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:57.318664074 CET	43632	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:57.438188076 CET	777	43632	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:57.438246012 CET	43632	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:57.438266993 CET	43632	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:57.557908058 CET	777	43632	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:57.557960987 CET	43632	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:57.677620888 CET	777	43632	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:58.735183954 CET	777	43632	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:58.735250950 CET	43632	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:58.735282898 CET	43632	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:58.869714022 CET	43634	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:58.989737988 CET	777	43634	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:58.989794016 CET	43634	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:58.989823103 CET	43634	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:59.109776020 CET	777	43634	154.216.19.138	192.168.2.23
Dec 25, 2024 11:12:59.109832048 CET	43634	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:12:59.229471922 CET	777	43634	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:00.292265892 CET	777	43634	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:00.292325974 CET	43634	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:00.292356014 CET	43634	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:00.415014029 CET	43636	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:00.534611940 CET	777	43636	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:00.534686089 CET	43636	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:00.534687042 CET	43636	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:00.654788971 CET	777	43636	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:00.654844999 CET	43636	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:00.774442911 CET	777	43636	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:01.838630915 CET	777	43636	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:01.838700056 CET	43636	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:01.838718891 CET	43636	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:01.973566055 CET	43638	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:02.093521118 CET	777	43638	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:02.093596935 CET	43638	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:02.093621969 CET	43638	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:02.213196039 CET	777	43638	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:02.213260889 CET	43638	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:02.332813025 CET	777	43638	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:03.392122030 CET	777	43638	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:03.392189026 CET	43638	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:03.392200947 CET	43638	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:03.514816046 CET	43640	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:03.634458065 CET	777	43640	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:03.634522915 CET	43640	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:03.634541988 CET	43640	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:03.754182100 CET	777	43640	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:03.754241943 CET	43640	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:03.873923063 CET	777	43640	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:04.933958054 CET	777	43640	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:04.934041023 CET	43640	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:04.934041023 CET	43640	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:05.068062067 CET	43642	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:05.187906981 CET	777	43642	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:05.187978983 CET	43642	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:05.188033104 CET	43642	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:05.307838917 CET	777	43642	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:05.307904959 CET	43642	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:05.427496910 CET	777	43642	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:06.488043070 CET	777	43642	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:06.488111019 CET	43642	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:06.488111019 CET	43642	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:06.622174025 CET	43644	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:06.742032051 CET	777	43644	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:06.742089987 CET	43644	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:06.742106915 CET	43644	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:06.861788034 CET	777	43644	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:06.861838102 CET	43644	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:06.981412888 CET	777	43644	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:08.045381069 CET	777	43644	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:08.045459032 CET	43644	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:08.045483112 CET	43644	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:08.180247068 CET	43646	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:08.299962044 CET	777	43646	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:08.300028086 CET	43646	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:08.300043106 CET	43646	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:08.419842958 CET	777	43646	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:08.419897079 CET	43646	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:08.539616108 CET	777	43646	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:09.598320007 CET	777	43646	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:09.598387957 CET	43646	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:09.598387957 CET	43646	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:09.733206987 CET	43648	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:09.853030920 CET	777	43648	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:09.853091002 CET	43648	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:09.853112936 CET	43648	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:09.972729921 CET	777	43648	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:09.972786903 CET	43648	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:10.092786074 CET	777	43648	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:11.152765036 CET	777	43648	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:11.152853966 CET	43648	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:11.152934074 CET	43648	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:11.275865078 CET	43650	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:11.395682096 CET	777	43650	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:11.395766020 CET	43650	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:11.395817995 CET	43650	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:11.515535116 CET	777	43650	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:11.515616894 CET	43650	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:11.635431051 CET	777	43650	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:12.694097996 CET	777	43650	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:12.694164991 CET	43650	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:12.694201946 CET	43650	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:12.828125000 CET	43652	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:12.947845936 CET	777	43652	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:12.947921991 CET	43652	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:12.947951078 CET	43652	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:13.067641973 CET	777	43652	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:13.067711115 CET	43652	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:13.188215971 CET	777	43652	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:14.245925903 CET	777	43652	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:14.246007919 CET	43652	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:14.246040106 CET	43652	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:14.368665934 CET	43654	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:14.489182949 CET	777	43654	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:14.489273071 CET	43654	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:14.489351034 CET	43654	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:14.608971119 CET	777	43654	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:14.609035969 CET	43654	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:14.728698969 CET	777	43654	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:15.790755987 CET	777	43654	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:15.790832043 CET	43654	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:15.790863991 CET	43654	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:15.925455093 CET	43656	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:16.045277119 CET	777	43656	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:16.045433998 CET	43656	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:16.045527935 CET	43656	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:16.165159941 CET	777	43656	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:16.165229082 CET	43656	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:16.284811974 CET	777	43656	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:17.346940041 CET	777	43656	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:17.347011089 CET	43656	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:17.347039938 CET	43656	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:17.469754934 CET	43658	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:17.589472055 CET	777	43658	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:17.589581013 CET	43658	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:17.589653015 CET	43658	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:17.709244967 CET	777	43658	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:17.709343910 CET	43658	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:17.828922033 CET	777	43658	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:18.891206980 CET	777	43658	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:18.891274929 CET	43658	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:18.891324997 CET	43658	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:19.031794071 CET	43660	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:19.151406050 CET	777	43660	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:19.151465893 CET	43660	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:19.151503086 CET	43660	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:19.271039009 CET	777	43660	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:19.271090984 CET	43660	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:19.390742064 CET	777	43660	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:20.450731993 CET	777	43660	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:20.450805902 CET	43660	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:20.450848103 CET	43660	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:20.573666096 CET	43662	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:20.693249941 CET	777	43662	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:20.693314075 CET	43662	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:20.693345070 CET	43662	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:20.812918901 CET	777	43662	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:20.812979937 CET	43662	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:20.932702065 CET	777	43662	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:21.990530968 CET	777	43662	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:21.990598917 CET	43662	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:21.990624905 CET	43662	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:22.113394976 CET	43664	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:22.232973099 CET	777	43664	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:22.233027935 CET	43664	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:22.233052015 CET	43664	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:22.352659941 CET	777	43664	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:22.352711916 CET	43664	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:22.472388983 CET	777	43664	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:23.532548904 CET	777	43664	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:23.532610893 CET	43664	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:23.532630920 CET	43664	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:23.666578054 CET	43666	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:23.786254883 CET	777	43666	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:23.786328077 CET	43666	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:23.786355019 CET	43666	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:23.906105042 CET	777	43666	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:23.906167030 CET	43666	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:24.025764942 CET	777	43666	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:25.089015007 CET	777	43666	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:25.089078903 CET	43666	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:25.089102030 CET	43666	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:25.211853981 CET	43668	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:25.331522942 CET	777	43668	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:25.331588030 CET	43668	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:25.331630945 CET	43668	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:25.451183081 CET	777	43668	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:25.451256037 CET	43668	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:25.570812941 CET	777	43668	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:26.628890991 CET	777	43668	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:26.628969908 CET	43668	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:26.628971100 CET	43668	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:26.762830019 CET	43670	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:26.882752895 CET	777	43670	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:26.882827044 CET	43670	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:26.882865906 CET	43670	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:27.002501965 CET	777	43670	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:27.002562046 CET	43670	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:27.122291088 CET	777	43670	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:28.182212114 CET	777	43670	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:28.182292938 CET	43670	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:28.182343960 CET	43670	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:28.305017948 CET	43672	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:28.424701929 CET	777	43672	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:28.424767971 CET	43672	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:28.424817085 CET	43672	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:28.544372082 CET	777	43672	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:28.544425964 CET	43672	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:28.663999081 CET	777	43672	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:29.724039078 CET	777	43672	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:29.724114895 CET	43672	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:29.724200964 CET	43672	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:29.858326912 CET	43674	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:29.977998018 CET	777	43674	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:29.978079081 CET	43674	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:29.978168011 CET	43674	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:30.355565071 CET	43674	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:30.432658911 CET	777	43674	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:30.475141048 CET	777	43674	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:31.390266895 CET	777	43674	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:31.390352964 CET	43674	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:31.510296106 CET	777	43674	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:32.525151014 CET	43676	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:32.644776106 CET	777	43676	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:32.644853115 CET	43676	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:32.644906044 CET	43676	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:32.764579058 CET	777	43676	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:32.764633894 CET	43676	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:32.884201050 CET	777	43676	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:33.947057962 CET	777	43676	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:33.947149992 CET	43676	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:33.947212934 CET	43676	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:34.082669020 CET	43678	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:34.202270031 CET	777	43678	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:34.202332020 CET	43678	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:34.202373028 CET	43678	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:34.321896076 CET	777	43678	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:34.321938992 CET	43678	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:34.442183971 CET	777	43678	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:35.501367092 CET	777	43678	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:35.501445055 CET	43678	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:35.501499891 CET	43678	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:35.624085903 CET	43680	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:35.743685961 CET	777	43680	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:35.743751049 CET	43680	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:35.743797064 CET	43680	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:35.863445044 CET	777	43680	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:35.863504887 CET	43680	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:35.983139992 CET	777	43680	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:37.043559074 CET	777	43680	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:37.043627977 CET	43680	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:37.043648958 CET	43680	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:37.177747011 CET	43682	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:37.297487974 CET	777	43682	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:37.297547102 CET	43682	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:37.297578096 CET	43682	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:37.417150021 CET	777	43682	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:37.417201996 CET	43682	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:37.536840916 CET	777	43682	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:38.596805096 CET	777	43682	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:38.596879959 CET	43682	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:38.596909046 CET	43682	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:38.731041908 CET	43684	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:38.850614071 CET	777	43684	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:38.850683928 CET	43684	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:38.850714922 CET	43684	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:38.970388889 CET	777	43684	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:38.970439911 CET	43684	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:39.090002060 CET	777	43684	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:40.150227070 CET	777	43684	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:40.150290966 CET	43684	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:40.150360107 CET	43684	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:40.284950972 CET	43686	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:40.404539108 CET	777	43686	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:40.404599905 CET	43686	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:40.404632092 CET	43686	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:40.525347948 CET	777	43686	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:40.525403023 CET	43686	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:40.644934893 CET	777	43686	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:41.703231096 CET	777	43686	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:41.703340054 CET	43686	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:41.703340054 CET	43686	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:41.837260008 CET	43688	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:41.956864119 CET	777	43688	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:41.956937075 CET	43688	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:41.956990004 CET	43688	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:42.076562881 CET	777	43688	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:42.076630116 CET	43688	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:42.196187973 CET	777	43688	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:43.258847952 CET	777	43688	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:43.258929968 CET	43688	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:43.259007931 CET	43688	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:43.392864943 CET	43690	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:43.512424946 CET	777	43690	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:43.512495995 CET	43690	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:43.512540102 CET	43690	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:43.632066965 CET	777	43690	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:43.632131100 CET	43690	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:43.751704931 CET	777	43690	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:44.809906006 CET	777	43690	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:44.809973955 CET	43690	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:44.810015917 CET	43690	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:44.944020987 CET	43692	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:45.063591003 CET	777	43692	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:45.063664913 CET	43692	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:45.063700914 CET	43692	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:45.183293104 CET	777	43692	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:45.183353901 CET	43692	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:45.303216934 CET	777	43692	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:46.370140076 CET	777	43692	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:46.370219946 CET	43692	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:46.370264053 CET	43692	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:46.492975950 CET	43694	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:46.612531900 CET	777	43694	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:46.612624884 CET	43694	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:46.612682104 CET	43694	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:46.732263088 CET	777	43694	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:46.732356071 CET	43694	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:46.852570057 CET	777	43694	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:47.915446043 CET	777	43694	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:47.915555954 CET	43694	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:47.915671110 CET	43694	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:48.050403118 CET	43696	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:48.169967890 CET	777	43696	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:48.170032978 CET	43696	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:48.170058966 CET	43696	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:48.289779902 CET	777	43696	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:48.289841890 CET	43696	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:48.409519911 CET	777	43696	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:49.470721960 CET	777	43696	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:49.470778942 CET	43696	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:49.470798969 CET	43696	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:49.593239069 CET	43698	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:49.712866068 CET	777	43698	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:49.712959051 CET	43698	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:49.713000059 CET	43698	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:49.832753897 CET	777	43698	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:49.832812071 CET	43698	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:49.952358007 CET	777	43698	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:51.013788939 CET	777	43698	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:51.013854027 CET	43698	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:51.013892889 CET	43698	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:51.148080111 CET	43700	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:51.268001080 CET	777	43700	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:51.268064022 CET	43700	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:51.268093109 CET	43700	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:51.387593031 CET	777	43700	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:51.387639999 CET	43700	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:51.507297993 CET	777	43700	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:52.568382025 CET	777	43700	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:52.568448067 CET	43700	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:52.568480015 CET	43700	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:52.691067934 CET	43702	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:52.810661077 CET	777	43702	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:52.810719013 CET	43702	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:52.810749054 CET	43702	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:52.930295944 CET	777	43702	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:52.930344105 CET	43702	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:53.049890041 CET	777	43702	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:54.111474037 CET	777	43702	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:54.111532927 CET	43702	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:54.111567020 CET	43702	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:54.234183073 CET	43704	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:54.353962898 CET	777	43704	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:54.354024887 CET	43704	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:54.354043007 CET	43704	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:54.473642111 CET	777	43704	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:54.473697901 CET	43704	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:54.593302965 CET	777	43704	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:55.654073954 CET	777	43704	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:55.654134035 CET	43704	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:55.654175043 CET	43704	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:55.788230896 CET	43706	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:55.907819033 CET	777	43706	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:55.907886982 CET	43706	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:55.907903910 CET	43706	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:56.027503014 CET	777	43706	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:56.027559042 CET	43706	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:56.147229910 CET	777	43706	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:57.205653906 CET	777	43706	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:57.205718994 CET	43706	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:57.205749035 CET	43706	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:57.328447104 CET	43708	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:57.448026896 CET	777	43708	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:57.448087931 CET	43708	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:57.448163033 CET	43708	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:57.567688942 CET	777	43708	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:57.567781925 CET	43708	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:57.687365055 CET	777	43708	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:58.749574900 CET	777	43708	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:58.749738932 CET	43708	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:58.749772072 CET	43708	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:58.872327089 CET	43710	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:58.992014885 CET	777	43710	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:58.992074013 CET	43710	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:58.992103100 CET	43710	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:59.111769915 CET	777	43710	154.216.19.138	192.168.2.23
Dec 25, 2024 11:13:59.111821890 CET	43710	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:13:59.231445074 CET	777	43710	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:00.292054892 CET	777	43710	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:00.292119980 CET	43710	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:00.292143106 CET	43710	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:00.782927036 CET	43712	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:00.902573109 CET	777	43712	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:00.902647972 CET	43712	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:00.902724981 CET	43712	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:01.022331953 CET	777	43712	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:01.022392988 CET	43712	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:01.141916990 CET	777	43712	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:02.202475071 CET	777	43712	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:02.202548981 CET	43712	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:02.202549934 CET	43712	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:02.325324059 CET	43714	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:02.444858074 CET	777	43714	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:02.444931984 CET	43714	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:02.444973946 CET	43714	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:02.564603090 CET	777	43714	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:02.564662933 CET	43714	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:02.684329987 CET	777	43714	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:03.744950056 CET	777	43714	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:03.745054960 CET	43714	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:03.745054960 CET	43714	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:03.879220009 CET	43716	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:03.998915911 CET	777	43716	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:03.998975039 CET	43716	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:03.999001980 CET	43716	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:04.118947983 CET	777	43716	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:04.119004011 CET	43716	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:04.238528013 CET	777	43716	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:05.295566082 CET	777	43716	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:05.295638084 CET	43716	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:05.295661926 CET	43716	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:05.430134058 CET	43718	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:05.549865007 CET	777	43718	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:05.549932003 CET	43718	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:05.549959898 CET	43718	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:05.669606924 CET	777	43718	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:05.669670105 CET	43718	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:05.789366007 CET	777	43718	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:06.852127075 CET	777	43718	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:06.852189064 CET	43718	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:06.852212906 CET	43718	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:06.986488104 CET	43720	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:07.106318951 CET	777	43720	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:07.106389999 CET	43720	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:07.106442928 CET	43720	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:07.226037025 CET	777	43720	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:07.226093054 CET	43720	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:07.345731020 CET	777	43720	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:08.407649040 CET	777	43720	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:08.407723904 CET	43720	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:08.407723904 CET	43720	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:08.541799068 CET	43722	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:08.661441088 CET	777	43722	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:08.661587000 CET	43722	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:08.661587000 CET	43722	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:08.781229973 CET	777	43722	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:08.781299114 CET	43722	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:08.900835991 CET	777	43722	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:09.960592031 CET	777	43722	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:09.960673094 CET	43722	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:09.960673094 CET	43722	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:10.083342075 CET	43724	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:10.203197956 CET	777	43724	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:10.203289986 CET	43724	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:10.203289986 CET	43724	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:10.322983027 CET	777	43724	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:10.323040009 CET	43724	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:10.442612886 CET	777	43724	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:11.503859997 CET	777	43724	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:11.503923893 CET	43724	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:11.503977060 CET	43724	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:11.638039112 CET	43726	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:11.758589029 CET	777	43726	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:11.758655071 CET	43726	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:11.758696079 CET	43726	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:11.878267050 CET	777	43726	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:11.878324986 CET	43726	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:11.999735117 CET	777	43726	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:13.055205107 CET	777	43726	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:13.055299997 CET	43726	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:13.055299997 CET	43726	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:13.177977085 CET	43728	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:13.297584057 CET	777	43728	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:13.297677040 CET	43728	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:13.297693968 CET	43728	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:13.417406082 CET	777	43728	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:13.417458057 CET	43728	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:13.537079096 CET	777	43728	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:14.601931095 CET	777	43728	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:14.601999044 CET	43728	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:14.601999044 CET	43728	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:14.724919081 CET	43730	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:14.844585896 CET	777	43730	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:14.844655037 CET	43730	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:14.844669104 CET	43730	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:14.964430094 CET	777	43730	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:14.964495897 CET	43730	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:15.084507942 CET	777	43730	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:16.142204046 CET	777	43730	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:16.142276049 CET	43730	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:16.142296076 CET	43730	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:16.265058041 CET	43732	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:16.384696007 CET	777	43732	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:16.384780884 CET	43732	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:16.384780884 CET	43732	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:16.504508018 CET	777	43732	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:16.504570961 CET	43732	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:16.624362946 CET	777	43732	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:17.686098099 CET	777	43732	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:17.686157942 CET	43732	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:17.686186075 CET	43732	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:17.819817066 CET	43734	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:17.939444065 CET	777	43734	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:17.939507961 CET	43734	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:17.939533949 CET	43734	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:18.059331894 CET	777	43734	154.216.19.138	192.168.2.23
Dec 25, 2024 11:14:18.059386015 CET	43734	777	192.168.2.23	154.216.19.138
Dec 25, 2024 11:14:18.179024935 CET	777	43734	154.216.19.138	192.168.2.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 25, 2024 11:11:47.614557028 CET	59028	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:11:48.230042934 CET	53	59028	8.8.8.8	192.168.2.23
Dec 25, 2024 11:11:49.648739100 CET	35881	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:11:50.505964041 CET	53	35881	8.8.8.8	192.168.2.23
Dec 25, 2024 11:11:51.929550886 CET	36539	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:11:52.063813925 CET	53	36539	8.8.8.8	192.168.2.23
Dec 25, 2024 11:11:53.484040976 CET	56895	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:11:53.499772072 CET	60397	53	192.168.2.23	1.1.1.1
Dec 25, 2024 11:11:53.499814034 CET	50583	53	192.168.2.23	1.1.1.1
Dec 25, 2024 11:11:53.619055033 CET	53	56895	8.8.8.8	192.168.2.23
Dec 25, 2024 11:11:53.640527010 CET	53	50583	1.1.1.1	192.168.2.23
Dec 25, 2024 11:11:53.731749058 CET	53	60397	1.1.1.1	192.168.2.23
Dec 25, 2024 11:11:55.038880110 CET	41160	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:11:56.001106024 CET	53	41160	8.8.8.8	192.168.2.23
Dec 25, 2024 11:11:57.421000957 CET	53585	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:11:57.554686069 CET	53	53585	8.8.8.8	192.168.2.23
Dec 25, 2024 11:11:58.972033024 CET	52041	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:11:59.106168032 CET	53	52041	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:00.525075912 CET	54997	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:00.658674955 CET	53	54997	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:02.078805923 CET	35295	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:02.773844004 CET	53	35295	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:04.194586039 CET	40028	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:05.143172979 CET	53	40028	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:06.563153982 CET	57267	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:06.685764074 CET	53	57267	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:08.105824947 CET	60126	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:08.239491940 CET	53	60126	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:09.672738075 CET	44825	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:09.806528091 CET	53	44825	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:11.224011898 CET	54858	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:11.358479977 CET	53	54858	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:12.780937910 CET	52861	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:12.914948940 CET	53	52861	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:14.334954977 CET	60978	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:14.468970060 CET	53	60978	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:15.889220953 CET	53666	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:16.022998095 CET	53	53666	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:17.443358898 CET	37834	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:18.338660955 CET	53	37834	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:19.756287098 CET	42933	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:19.889991999 CET	53	42933	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:21.309474945 CET	56683	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:21.443222046 CET	53	56683	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:22.861948967 CET	43112	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:23.585313082 CET	53	43112	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:25.008229971 CET	49895	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:25.150352955 CET	53	49895	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:27.683530092 CET	43676	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:27.817876101 CET	53	43676	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:29.240051985 CET	42935	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:29.373975992 CET	53	42935	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:30.799580097 CET	44140	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:30.933640957 CET	53	44140	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:32.353044987 CET	45832	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:32.475663900 CET	53	45832	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:33.898802996 CET	52683	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:34.032963991 CET	53	52683	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:35.452204943 CET	33360	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:35.586071968 CET	53	33360	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:37.002666950 CET	53914	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:37.136900902 CET	53	53914	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:38.556257963 CET	40579	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:38.690426111 CET	53	40579	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:40.112824917 CET	57289	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:40.235296965 CET	53	57289	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:41.655035973 CET	44610	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:41.789944887 CET	53	44610	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:43.209753036 CET	42623	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:43.344304085 CET	53	42623	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:44.765981913 CET	35072	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:44.900342941 CET	53	35072	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:46.318722963 CET	57966	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:46.453784943 CET	53	57966	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:47.875360012 CET	46717	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:48.009421110 CET	53	46717	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:49.429063082 CET	40375	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:49.562738895 CET	53	40375	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:50.981379986 CET	57614	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:51.104038954 CET	53	57614	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:52.523662090 CET	55281	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:52.657946110 CET	53	55281	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:54.081089020 CET	43781	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:54.220086098 CET	53	43781	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:55.641804934 CET	38418	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:55.764244080 CET	53	38418	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:57.184748888 CET	60078	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:57.318578005 CET	53	60078	8.8.8.8	192.168.2.23
Dec 25, 2024 11:12:58.735333920 CET	48529	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:12:58.869633913 CET	53	48529	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:00.292391062 CET	35245	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:00.414932013 CET	53	35245	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:01.838778019 CET	49595	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:01.973463058 CET	53	49595	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:03.392255068 CET	58852	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:03.514731884 CET	53	58852	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:04.934073925 CET	58558	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:05.067985058 CET	53	58558	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:06.488164902 CET	39228	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:06.622083902 CET	53	39228	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:08.045526028 CET	39728	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:08.180160046 CET	53	39728	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:09.598541021 CET	38352	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:09.733124971 CET	53	38352	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:11.152960062 CET	39353	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:11.275712967 CET	53	39353	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:12.694237947 CET	57126	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:12.828035116 CET	53	57126	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:14.246114016 CET	45746	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:14.368532896 CET	53	45746	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:15.790935993 CET	42841	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:15.925303936 CET	53	42841	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:17.347104073 CET	45910	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:17.469574928 CET	53	45910	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:18.891361952 CET	55391	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:19.031697035 CET	53	55391	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:20.450911999 CET	39565	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:20.573590040 CET	53	39565	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:21.990782022 CET	45444	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:22.113318920 CET	53	45444	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:23.532696962 CET	58800	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:23.666495085 CET	53	58800	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:25.089143038 CET	44968	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:25.211707115 CET	53	44968	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:26.629060030 CET	54721	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:26.762742996 CET	53	54721	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:28.182368994 CET	36501	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:28.304902077 CET	53	36501	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:29.724185944 CET	46602	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:29.858094931 CET	53	46602	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:32.391096115 CET	54641	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:32.525044918 CET	53	54641	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:33.947262049 CET	46947	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:34.082561970 CET	53	46947	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:35.501565933 CET	33131	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:35.623971939 CET	53	33131	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:37.043698072 CET	55991	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:37.177670002 CET	53	55991	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:38.596963882 CET	55299	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:38.730937958 CET	53	55299	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:40.150377035 CET	57822	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:40.284864902 CET	53	57822	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:41.703392982 CET	36391	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:41.837157011 CET	53	36391	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:43.258982897 CET	35957	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:43.392784119 CET	53	35957	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:44.810071945 CET	50704	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:44.943914890 CET	53	50704	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:46.370302916 CET	49846	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:46.492887974 CET	53	49846	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:47.915751934 CET	44971	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:48.050261974 CET	53	44971	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:49.470855951 CET	37607	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:49.593156099 CET	53	37607	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:51.013957024 CET	51538	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:51.147974014 CET	53	51538	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:52.568501949 CET	60659	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:52.690977097 CET	53	60659	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:54.111644030 CET	55673	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:54.234092951 CET	53	55673	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:55.654201031 CET	32825	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:55.788163900 CET	53	32825	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:57.205797911 CET	59756	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:57.328290939 CET	53	59756	8.8.8.8	192.168.2.23
Dec 25, 2024 11:13:58.749841928 CET	47699	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:13:58.872248888 CET	53	47699	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:00.292200089 CET	41386	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:00.782830000 CET	53	41386	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:02.202615976 CET	36542	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:02.325238943 CET	53	36542	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:03.745146990 CET	41978	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:03.879137993 CET	53	41978	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:05.295705080 CET	53715	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:05.430051088 CET	53	53715	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:06.852263927 CET	53324	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:06.986406088 CET	53	53324	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:08.407761097 CET	51266	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:08.541718006 CET	53	51266	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:09.960715055 CET	53408	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:10.083245039 CET	53	53408	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:11.503992081 CET	59816	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:11.637960911 CET	53	59816	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:13.055363894 CET	50998	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:13.177898884 CET	53	50998	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:14.602061987 CET	37549	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:14.724833965 CET	53	37549	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:16.142344952 CET	35173	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:16.264976978 CET	53	35173	8.8.8.8	192.168.2.23
Dec 25, 2024 11:14:17.686219931 CET	42151	53	192.168.2.23	8.8.8.8
Dec 25, 2024 11:14:17.819737911 CET	53	42151	8.8.8.8	192.168.2.23

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 25, 2024 11:11:57.206677914 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 25, 2024 11:13:17.221915007 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 25, 2024 11:11:47.614557028 CET	192.168.2.23	8.8.8.8	0x72ac	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:49.648739100 CET	192.168.2.23	8.8.8.8	0xe3f1	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:51.929550886 CET	192.168.2.23	8.8.8.8	0x9faa	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:53.484040976 CET	192.168.2.23	8.8.8.8	0x6230	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:53.499772072 CET	192.168.2.23	1.1.1.1	0xd8b1	Standard query (0)	daisy.ubuntu.com	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:53.499814034 CET	192.168.2.23	1.1.1.1	0x9371	Standard query (0)	daisy.ubuntu.com	28	IN (0x0001)	false
Dec 25, 2024 11:11:55.038880110 CET	192.168.2.23	8.8.8.8	0x818b	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:57.421000957 CET	192.168.2.23	8.8.8.8	0xce56	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:58.972033024 CET	192.168.2.23	8.8.8.8	0x740	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:00.525075912 CET	192.168.2.23	8.8.8.8	0xd05e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:02.078805923 CET	192.168.2.23	8.8.8.8	0x7aa8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:04.194586039 CET	192.168.2.23	8.8.8.8	0x5bc1	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:06.563153982 CET	192.168.2.23	8.8.8.8	0x81b8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:08.105824947 CET	192.168.2.23	8.8.8.8	0xf38a	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:09.672738075 CET	192.168.2.23	8.8.8.8	0xb1d5	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:11.224011898 CET	192.168.2.23	8.8.8.8	0x2802	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:12.780937910 CET	192.168.2.23	8.8.8.8	0x5383	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:14.334954977 CET	192.168.2.23	8.8.8.8	0xb53	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:15.889220953 CET	192.168.2.23	8.8.8.8	0x25b8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:17.443358898 CET	192.168.2.23	8.8.8.8	0xaa88	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:19.756287098 CET	192.168.2.23	8.8.8.8	0x400f	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:21.309474945 CET	192.168.2.23	8.8.8.8	0xdd76	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:22.861948967 CET	192.168.2.23	8.8.8.8	0xce24	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:25.008229971 CET	192.168.2.23	8.8.8.8	0xc226	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:27.683530092 CET	192.168.2.23	8.8.8.8	0xc859	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:29.240051985 CET	192.168.2.23	8.8.8.8	0x4f6a	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:30.799580097 CET	192.168.2.23	8.8.8.8	0x2f0d	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:32.353044987 CET	192.168.2.23	8.8.8.8	0xb3f8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:33.898802996 CET	192.168.2.23	8.8.8.8	0x5eb8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:35.452204943 CET	192.168.2.23	8.8.8.8	0x4595	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:37.002666950 CET	192.168.2.23	8.8.8.8	0x338f	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:38.556257963 CET	192.168.2.23	8.8.8.8	0xc3ca	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:40.112824917 CET	192.168.2.23	8.8.8.8	0xb0af	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:41.655035973 CET	192.168.2.23	8.8.8.8	0x4baf	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:43.209753036 CET	192.168.2.23	8.8.8.8	0xab85	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:44.765981913 CET	192.168.2.23	8.8.8.8	0x8cb8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:46.318722963 CET	192.168.2.23	8.8.8.8	0x7cc5	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:47.875360012 CET	192.168.2.23	8.8.8.8	0x6965	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:49.429063082 CET	192.168.2.23	8.8.8.8	0x454e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:50.981379986 CET	192.168.2.23	8.8.8.8	0x22c3	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:52.523662090 CET	192.168.2.23	8.8.8.8	0x787d	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:54.081089020 CET	192.168.2.23	8.8.8.8	0xab9d	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:55.641804934 CET	192.168.2.23	8.8.8.8	0x86e1	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:57.184748888 CET	192.168.2.23	8.8.8.8	0x80a6	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:58.735333920 CET	192.168.2.23	8.8.8.8	0x3db2	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:00.292391062 CET	192.168.2.23	8.8.8.8	0x2b70	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:01.838778019 CET	192.168.2.23	8.8.8.8	0xc23a	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:03.392255068 CET	192.168.2.23	8.8.8.8	0x4981	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:04.934073925 CET	192.168.2.23	8.8.8.8	0x55e8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:06.488164902 CET	192.168.2.23	8.8.8.8	0x98f9	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:08.045526028 CET	192.168.2.23	8.8.8.8	0x570b	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:09.598541021 CET	192.168.2.23	8.8.8.8	0xedeb	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:11.152960062 CET	192.168.2.23	8.8.8.8	0xdcb9	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:12.694237947 CET	192.168.2.23	8.8.8.8	0x4f2e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:14.246114016 CET	192.168.2.23	8.8.8.8	0x64a0	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:15.790935993 CET	192.168.2.23	8.8.8.8	0x8e5e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:17.347104073 CET	192.168.2.23	8.8.8.8	0xe948	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:18.891361952 CET	192.168.2.23	8.8.8.8	0xc8de	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:20.450911999 CET	192.168.2.23	8.8.8.8	0xded8	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:21.990782022 CET	192.168.2.23	8.8.8.8	0x7c69	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:23.532696962 CET	192.168.2.23	8.8.8.8	0x379e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:25.089143038 CET	192.168.2.23	8.8.8.8	0xb5a4	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:26.629060030 CET	192.168.2.23	8.8.8.8	0x73ed	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:28.182368994 CET	192.168.2.23	8.8.8.8	0xc78a	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:29.724185944 CET	192.168.2.23	8.8.8.8	0xbfe9	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:32.391096115 CET	192.168.2.23	8.8.8.8	0x8479	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:33.947262049 CET	192.168.2.23	8.8.8.8	0xfdac	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:35.501565933 CET	192.168.2.23	8.8.8.8	0xee82	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:37.043698072 CET	192.168.2.23	8.8.8.8	0xdc32	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:38.596963882 CET	192.168.2.23	8.8.8.8	0xb125	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:40.150377035 CET	192.168.2.23	8.8.8.8	0xd569	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:41.703392982 CET	192.168.2.23	8.8.8.8	0xfd39	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:43.258982897 CET	192.168.2.23	8.8.8.8	0xd5d5	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:44.810071945 CET	192.168.2.23	8.8.8.8	0x7a0e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:46.370302916 CET	192.168.2.23	8.8.8.8	0x765c	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:47.915751934 CET	192.168.2.23	8.8.8.8	0xeb6d	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:49.470855951 CET	192.168.2.23	8.8.8.8	0x53f6	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:51.013957024 CET	192.168.2.23	8.8.8.8	0x2a18	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:52.568501949 CET	192.168.2.23	8.8.8.8	0x7a5	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:54.111644030 CET	192.168.2.23	8.8.8.8	0xc64f	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:55.654201031 CET	192.168.2.23	8.8.8.8	0xffe3	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:57.205797911 CET	192.168.2.23	8.8.8.8	0x3c1e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:58.749841928 CET	192.168.2.23	8.8.8.8	0x620e	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:00.292200089 CET	192.168.2.23	8.8.8.8	0xd63a	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:02.202615976 CET	192.168.2.23	8.8.8.8	0xd7a6	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:03.745146990 CET	192.168.2.23	8.8.8.8	0xfe34	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:05.295705080 CET	192.168.2.23	8.8.8.8	0xbc27	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:06.852263927 CET	192.168.2.23	8.8.8.8	0x7dda	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:08.407761097 CET	192.168.2.23	8.8.8.8	0xc60c	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:09.960715055 CET	192.168.2.23	8.8.8.8	0x5b52	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:11.503992081 CET	192.168.2.23	8.8.8.8	0x2f4c	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:13.055363894 CET	192.168.2.23	8.8.8.8	0x831d	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:14.602061987 CET	192.168.2.23	8.8.8.8	0x9d59	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:16.142344952 CET	192.168.2.23	8.8.8.8	0x5f8f	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:17.686219931 CET	192.168.2.23	8.8.8.8	0xe7cc	Standard query (0)	vbtgsze.r-e.kr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 25, 2024 11:11:48.230042934 CET	8.8.8.8	192.168.2.23	0x72ac	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:50.505964041 CET	8.8.8.8	192.168.2.23	0xe3f1	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:52.063813925 CET	8.8.8.8	192.168.2.23	0x9faa	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:53.619055033 CET	8.8.8.8	192.168.2.23	0x6230	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:53.731749058 CET	1.1.1.1	192.168.2.23	0xd8b1	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:53.731749058 CET	1.1.1.1	192.168.2.23	0xd8b1	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:56.001106024 CET	8.8.8.8	192.168.2.23	0x818b	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:57.554686069 CET	8.8.8.8	192.168.2.23	0xce56	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:11:59.106168032 CET	8.8.8.8	192.168.2.23	0x740	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:00.658674955 CET	8.8.8.8	192.168.2.23	0xd05e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:02.773844004 CET	8.8.8.8	192.168.2.23	0x7aa8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:05.143172979 CET	8.8.8.8	192.168.2.23	0x5bc1	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:06.685764074 CET	8.8.8.8	192.168.2.23	0x81b8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:08.239491940 CET	8.8.8.8	192.168.2.23	0xf38a	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:09.806528091 CET	8.8.8.8	192.168.2.23	0xb1d5	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:11.358479977 CET	8.8.8.8	192.168.2.23	0x2802	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:12.914948940 CET	8.8.8.8	192.168.2.23	0x5383	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:14.468970060 CET	8.8.8.8	192.168.2.23	0xb53	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:16.022998095 CET	8.8.8.8	192.168.2.23	0x25b8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:18.338660955 CET	8.8.8.8	192.168.2.23	0xaa88	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:19.889991999 CET	8.8.8.8	192.168.2.23	0x400f	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:21.443222046 CET	8.8.8.8	192.168.2.23	0xdd76	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:23.585313082 CET	8.8.8.8	192.168.2.23	0xce24	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:25.150352955 CET	8.8.8.8	192.168.2.23	0xc226	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:27.817876101 CET	8.8.8.8	192.168.2.23	0xc859	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:29.373975992 CET	8.8.8.8	192.168.2.23	0x4f6a	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:30.933640957 CET	8.8.8.8	192.168.2.23	0x2f0d	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:32.475663900 CET	8.8.8.8	192.168.2.23	0xb3f8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:34.032963991 CET	8.8.8.8	192.168.2.23	0x5eb8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:35.586071968 CET	8.8.8.8	192.168.2.23	0x4595	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:37.136900902 CET	8.8.8.8	192.168.2.23	0x338f	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:38.690426111 CET	8.8.8.8	192.168.2.23	0xc3ca	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:40.235296965 CET	8.8.8.8	192.168.2.23	0xb0af	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:41.789944887 CET	8.8.8.8	192.168.2.23	0x4baf	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:43.344304085 CET	8.8.8.8	192.168.2.23	0xab85	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:44.900342941 CET	8.8.8.8	192.168.2.23	0x8cb8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:46.453784943 CET	8.8.8.8	192.168.2.23	0x7cc5	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:48.009421110 CET	8.8.8.8	192.168.2.23	0x6965	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:49.562738895 CET	8.8.8.8	192.168.2.23	0x454e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:51.104038954 CET	8.8.8.8	192.168.2.23	0x22c3	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:52.657946110 CET	8.8.8.8	192.168.2.23	0x787d	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:54.220086098 CET	8.8.8.8	192.168.2.23	0xab9d	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:55.764244080 CET	8.8.8.8	192.168.2.23	0x86e1	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:57.318578005 CET	8.8.8.8	192.168.2.23	0x80a6	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:12:58.869633913 CET	8.8.8.8	192.168.2.23	0x3db2	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:00.414932013 CET	8.8.8.8	192.168.2.23	0x2b70	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:01.973463058 CET	8.8.8.8	192.168.2.23	0xc23a	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:03.514731884 CET	8.8.8.8	192.168.2.23	0x4981	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:05.067985058 CET	8.8.8.8	192.168.2.23	0x55e8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:06.622083902 CET	8.8.8.8	192.168.2.23	0x98f9	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:08.180160046 CET	8.8.8.8	192.168.2.23	0x570b	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:09.733124971 CET	8.8.8.8	192.168.2.23	0xedeb	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:11.275712967 CET	8.8.8.8	192.168.2.23	0xdcb9	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:12.828035116 CET	8.8.8.8	192.168.2.23	0x4f2e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:14.368532896 CET	8.8.8.8	192.168.2.23	0x64a0	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:15.925303936 CET	8.8.8.8	192.168.2.23	0x8e5e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:17.469574928 CET	8.8.8.8	192.168.2.23	0xe948	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:19.031697035 CET	8.8.8.8	192.168.2.23	0xc8de	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:20.573590040 CET	8.8.8.8	192.168.2.23	0xded8	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:22.113318920 CET	8.8.8.8	192.168.2.23	0x7c69	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:23.666495085 CET	8.8.8.8	192.168.2.23	0x379e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:25.211707115 CET	8.8.8.8	192.168.2.23	0xb5a4	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:26.762742996 CET	8.8.8.8	192.168.2.23	0x73ed	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:28.304902077 CET	8.8.8.8	192.168.2.23	0xc78a	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:29.858094931 CET	8.8.8.8	192.168.2.23	0xbfe9	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:32.525044918 CET	8.8.8.8	192.168.2.23	0x8479	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:34.082561970 CET	8.8.8.8	192.168.2.23	0xfdac	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:35.623971939 CET	8.8.8.8	192.168.2.23	0xee82	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:37.177670002 CET	8.8.8.8	192.168.2.23	0xdc32	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:38.730937958 CET	8.8.8.8	192.168.2.23	0xb125	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:40.284864902 CET	8.8.8.8	192.168.2.23	0xd569	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:41.837157011 CET	8.8.8.8	192.168.2.23	0xfd39	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:43.392784119 CET	8.8.8.8	192.168.2.23	0xd5d5	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:44.943914890 CET	8.8.8.8	192.168.2.23	0x7a0e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:46.492887974 CET	8.8.8.8	192.168.2.23	0x765c	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:48.050261974 CET	8.8.8.8	192.168.2.23	0xeb6d	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:49.593156099 CET	8.8.8.8	192.168.2.23	0x53f6	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:51.147974014 CET	8.8.8.8	192.168.2.23	0x2a18	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:52.690977097 CET	8.8.8.8	192.168.2.23	0x7a5	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:54.234092951 CET	8.8.8.8	192.168.2.23	0xc64f	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:55.788163900 CET	8.8.8.8	192.168.2.23	0xffe3	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:57.328290939 CET	8.8.8.8	192.168.2.23	0x3c1e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:13:58.872248888 CET	8.8.8.8	192.168.2.23	0x620e	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:00.782830000 CET	8.8.8.8	192.168.2.23	0xd63a	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:02.325238943 CET	8.8.8.8	192.168.2.23	0xd7a6	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:03.879137993 CET	8.8.8.8	192.168.2.23	0xfe34	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:05.430051088 CET	8.8.8.8	192.168.2.23	0xbc27	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:06.986406088 CET	8.8.8.8	192.168.2.23	0x7dda	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:08.541718006 CET	8.8.8.8	192.168.2.23	0xc60c	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:10.083245039 CET	8.8.8.8	192.168.2.23	0x5b52	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:11.637960911 CET	8.8.8.8	192.168.2.23	0x2f4c	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:13.177898884 CET	8.8.8.8	192.168.2.23	0x831d	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:14.724833965 CET	8.8.8.8	192.168.2.23	0x9d59	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:16.264976978 CET	8.8.8.8	192.168.2.23	0x5f8f	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false
Dec 25, 2024 11:14:17.819737911 CET	8.8.8.8	192.168.2.23	0xe7cc	No error (0)	vbtgsze.r-e.kr	154.216.19.138	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: byte.x86.elf PID: 6227, Parent PID: 6154

General

Start time (UTC):	10:11:46
Start date (UTC):	25/12/2024
Path:	/tmp/byte.x86.elf
Arguments:	/tmp/byte.x86.elf
File size:	40108 bytes
MD5 hash:	2c34b1d26adb50c974d1d390199331b6

Chronological Activities

Analysis Process: byte.x86.elf PID: 6228, Parent PID: 6227

General

Start time (UTC):	10:11:46
Start date (UTC):	25/12/2024
Path:	/tmp/byte.x86.elf
Arguments:	-
File size:	40108 bytes
MD5 hash:	2c34b1d26adb50c974d1d390199331b6

Chronological Activities

Analysis Process: byte.x86.elf PID: 6229, Parent PID: 6227

General

Start time (UTC):	10:11:46
Start date (UTC):	25/12/2024
Path:	/tmp/byte.x86.elf
Arguments:	-
File size:	40108 bytes
MD5 hash:	2c34b1d26adb50c974d1d390199331b6

Chronological Activities

Analysis Process: byte.x86.elf PID: 6230, Parent PID: 6227

General

Start time (UTC):	10:11:46
Start date (UTC):	25/12/2024
Path:	/tmp/byte.x86.elf
Arguments:	-
File size:	40108 bytes
MD5 hash:	2c34b1d26adb50c974d1d390199331b6

Chronological Activities

Analysis Process: byte.x86.elf PID: 6231, Parent PID: 6230

General

Start time (UTC):	10:11:46
Start date (UTC):	25/12/2024
Path:	/tmp/byte.x86.elf
Arguments:	-
File size:	40108 bytes
MD5 hash:	2c34b1d26adb50c974d1d390199331b6

Chronological Activities

Analysis Process: byte.x86.elf PID: 6232, Parent PID: 6230

General

Start time (UTC):	10:11:46
Start date (UTC):	25/12/2024
Path:	/tmp/byte.x86.elf
Arguments:	-
File size:	40108 bytes
MD5 hash:	2c34b1d26adb50c974d1d390199331b6

Chronological Activities

Analysis Process: dash PID: 6233, Parent PID: 4331

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6233, Parent PID: 4331

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.fLxwiDY4PB /tmp/tmp.hganpvdKfL /tmp/tmp.SQMDf5QAdV
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: dash PID: 6234, Parent PID: 4331

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: rm PID: 6234, Parent PID: 4331

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.fLxwiDY4PB /tmp/tmp.hganpvdKfL /tmp/tmp.SQMDf5QAdV
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Chronological Activities

Analysis Process: systemd PID: 6259, Parent PID: 1

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6259, Parent PID: 1

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6273, Parent PID: 1

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6273, Parent PID: 1

General

Start time (UTC):	10:11:47
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6274, Parent PID: 1860

General

Start time (UTC):	10:11:48
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6274, Parent PID: 1860

General

Start time (UTC):	10:11:48
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: gvfsd-fuse PID: 6275, Parent PID: 2038

General

Start time (UTC):	10:11:48
Start date (UTC):	25/12/2024
Path:	/usr/libexec/gvfsd-fuse
Arguments:	-
File size:	47632 bytes
MD5 hash:	d18fbf1cbf8eb57b17fac48b7b4be933

Chronological Activities

Analysis Process: fusermount PID: 6275, Parent PID: 2038

General

Start time (UTC):	10:11:48
Start date (UTC):	25/12/2024
Path:	/bin/fusermount
Arguments:	fusermount -u -q -z -- /run/user/1000/gvfs
File size:	39144 bytes
MD5 hash:	576a1b135c82bdcbc97a91acea900566

Chronological Activities

Analysis Process: systemd PID: 6284, Parent PID: 1

General

Start time (UTC):	10:11:49
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6284, Parent PID: 1

General

Start time (UTC):	10:11:49
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6285, Parent PID: 1860

General

Start time (UTC):	10:11:49
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6285, Parent PID: 1860

General

Start time (UTC):	10:11:49
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6286, Parent PID: 1

General

Start time (UTC):	10:11:49
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6286, Parent PID: 1

General

Start time (UTC):	10:11:49
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6297, Parent PID: 1

General

Start time (UTC):	10:11:51
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-logind PID: 6297, Parent PID: 1

General

Start time (UTC):	10:11:51
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Chronological Activities

Analysis Process: systemd PID: 6354, Parent PID: 1

General

Start time (UTC):	10:11:51
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rtkit-daemon PID: 6354, Parent PID: 1

General

Start time (UTC):	10:11:51
Start date (UTC):	25/12/2024
Path:	/usr/libexec/rtkit-daemon
Arguments:	/usr/libexec/rtkit-daemon
File size:	68096 bytes
MD5 hash:	df0cacf1db4ec95ac70f5b6e06b8ffd7

Chronological Activities

Analysis Process: systemd PID: 6358, Parent PID: 1

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: polkitd PID: 6358, Parent PID: 1

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/usr/lib/policykit-1/polkitd
Arguments:	/usr/lib/policykit-1/polkitd --no-debug
File size:	121504 bytes
MD5 hash:	8efc9b4b5b524210ad2ea1954a9d0e69

Chronological Activities

Analysis Process: gdm3 PID: 6359, Parent PID: 1320

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6359, Parent PID: 1320

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 6362, Parent PID: 1320

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6362, Parent PID: 1320

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: gdm3 PID: 6363, Parent PID: 1320

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Chronological Activities

Analysis Process: Default PID: 6363, Parent PID: 1320

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/etc/gdm3/PrimeOff/Default
Arguments:	/etc/gdm3/PrimeOff/Default
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 6366, Parent PID: 1

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6366, Parent PID: 1

General

Start time (UTC):	10:11:52
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6367, Parent PID: 1860

General

Start time (UTC):	10:11:53
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6367, Parent PID: 1860

General

Start time (UTC):	10:11:53
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6368, Parent PID: 1

General

Start time (UTC):	10:11:53
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6368, Parent PID: 1

General

Start time (UTC):	10:11:53
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6373, Parent PID: 1

General

Start time (UTC):	10:11:53
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 6373, Parent PID: 1

General

Start time (UTC):	10:11:53
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 6374, Parent PID: 6373

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6374, Parent PID: 6373

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6376, Parent PID: 6374

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6376, Parent PID: 6374

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6377, Parent PID: 6373

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6377, Parent PID: 6373

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6378, Parent PID: 6377

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6378, Parent PID: 6377

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6379, Parent PID: 6373

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6379, Parent PID: 6373

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6380, Parent PID: 6379

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6380, Parent PID: 6379

General

Start time (UTC):	10:11:54
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6381, Parent PID: 6373

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6381, Parent PID: 6373

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6382, Parent PID: 6381

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6382, Parent PID: 6381

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6383, Parent PID: 6373

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6383, Parent PID: 6373

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6384, Parent PID: 6383

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6384, Parent PID: 6383

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: systemd PID: 6385, Parent PID: 1

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6385, Parent PID: 1

General

Start time (UTC):	10:11:55
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6386, Parent PID: 1

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6386, Parent PID: 1

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 6387, Parent PID: 6386

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6387, Parent PID: 6386

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 6388, Parent PID: 1860

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6388, Parent PID: 1860

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6389, Parent PID: 1

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6389, Parent PID: 1

General

Start time (UTC):	10:11:56
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6397, Parent PID: 1

General

Start time (UTC):	10:11:58
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6397, Parent PID: 1

General

Start time (UTC):	10:11:58
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6398, Parent PID: 1860

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6398, Parent PID: 1860

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6399, Parent PID: 1

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6399, Parent PID: 1

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6404, Parent PID: 1

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 6404, Parent PID: 1

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 6406, Parent PID: 6404

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6406, Parent PID: 6404

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6407, Parent PID: 6406

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6407, Parent PID: 6406

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6411, Parent PID: 6404

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6411, Parent PID: 6404

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6412, Parent PID: 6411

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6412, Parent PID: 6411

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6416, Parent PID: 6404

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6416, Parent PID: 6404

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6417, Parent PID: 6416

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6417, Parent PID: 6416

General

Start time (UTC):	10:12:01
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6419, Parent PID: 6404

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6419, Parent PID: 6404

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6420, Parent PID: 6419

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6420, Parent PID: 6419

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6423, Parent PID: 6404

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Analysis Process: systemd PID: 6405, Parent PID: 1

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6405, Parent PID: 1

General

Start time (UTC):	10:11:59
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6408, Parent PID: 1860

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6408, Parent PID: 1860

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6409, Parent PID: 1

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6409, Parent PID: 1

General

Start time (UTC):	10:12:00
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6424, Parent PID: 1

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6424, Parent PID: 1

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 6426, Parent PID: 6424

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6426, Parent PID: 6424

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 6425, Parent PID: 1

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6425, Parent PID: 1

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6427, Parent PID: 1860

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6427, Parent PID: 1860

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6428, Parent PID: 1

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6428, Parent PID: 1

General

Start time (UTC):	10:12:02
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6433, Parent PID: 1

General

Start time (UTC):	10:12:04
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6433, Parent PID: 1

General

Start time (UTC):	10:12:04
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6435, Parent PID: 1860

General

Start time (UTC):	10:12:04
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6435, Parent PID: 1860

General

Start time (UTC):	10:12:04
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6436, Parent PID: 1

General

Start time (UTC):	10:12:04
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6436, Parent PID: 1

General

Start time (UTC):	10:12:04
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6438, Parent PID: 1

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 6438, Parent PID: 1

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 6442, Parent PID: 6438

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6442, Parent PID: 6438

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6443, Parent PID: 6442

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6443, Parent PID: 6442

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6445, Parent PID: 6438

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6445, Parent PID: 6438

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6446, Parent PID: 6445

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6446, Parent PID: 6445

General

Start time (UTC):	10:12:05
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6447, Parent PID: 6438

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6447, Parent PID: 6438

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6448, Parent PID: 6447

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6448, Parent PID: 6447

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6449, Parent PID: 6438

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6449, Parent PID: 6438

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6450, Parent PID: 6449

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6450, Parent PID: 6449

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6452, Parent PID: 6438

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6452, Parent PID: 6438

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6454, Parent PID: 6452

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6454, Parent PID: 6452

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: systemd PID: 6453, Parent PID: 1

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rtkit-daemon PID: 6453, Parent PID: 1

General

Start time (UTC):	10:12:06
Start date (UTC):	25/12/2024
Path:	/usr/libexec/rtkit-daemon
Arguments:	/usr/libexec/rtkit-daemon
File size:	68096 bytes
MD5 hash:	df0cacf1db4ec95ac70f5b6e06b8ffd7

Chronological Activities

Analysis Process: systemd PID: 6455, Parent PID: 1

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6455, Parent PID: 1

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6456, Parent PID: 1

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6456, Parent PID: 1

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 6459, Parent PID: 6456

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6459, Parent PID: 6456

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 6457, Parent PID: 1860

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: pulseaudio PID: 6457, Parent PID: 1860

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/bin/pulseaudio
Arguments:	/usr/bin/pulseaudio --daemonize=no --log-target=journal
File size:	100832 bytes
MD5 hash:	0c3b4c789d8ffb12b25507f27e14c186

Chronological Activities

Analysis Process: systemd PID: 6458, Parent PID: 1

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: rsyslogd PID: 6458, Parent PID: 1

General

Start time (UTC):	10:12:07
Start date (UTC):	25/12/2024
Path:	/usr/sbin/rsyslogd
Arguments:	/usr/sbin/rsyslogd -n -iNONE
File size:	727248 bytes
MD5 hash:	0b8087fc907c42eb3c81a691db258e33

Chronological Activities

Analysis Process: systemd PID: 6466, Parent PID: 1

General

Start time (UTC):	10:12:09
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 6466, Parent PID: 1

General

Start time (UTC):	10:12:09
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: gpu-manager PID: 6467, Parent PID: 6466

General

Start time (UTC):	10:12:09
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6467, Parent PID: 6466

General

Start time (UTC):	10:12:09
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6468, Parent PID: 6467

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6468, Parent PID: 6467

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: gpu-manager PID: 6469, Parent PID: 6466

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: sh PID: 6469, Parent PID: 6466

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6470, Parent PID: 6469

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: grep PID: 6470, Parent PID: 6469

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/usr/bin/grep
Arguments:	grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
File size:	199136 bytes
MD5 hash:	1e6ebb9dd094f774478f72727bdba0f5

Chronological Activities

Analysis Process: systemd PID: 6471, Parent PID: 1

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6471, Parent PID: 1

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 6472, Parent PID: 6471

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6472, Parent PID: 6471

General

Start time (UTC):	10:12:10
Start date (UTC):	25/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 6473, Parent PID: 1

General

Start time (UTC):	10:12:12
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 6473, Parent PID: 1

General

Start time (UTC):	10:12:12
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: systemd PID: 6474, Parent PID: 1

General

Start time (UTC):	10:12:12
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6474, Parent PID: 1

General

Start time (UTC):	10:12:12
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: generate-config PID: 6477, Parent PID: 6474

General

Start time (UTC):	10:12:12
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6477, Parent PID: 6474

General

Start time (UTC):	10:12:12
Start date (UTC):	25/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill --signal HUP --uid gdm dconf-service
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: systemd PID: 6478, Parent PID: 1

General

Start time (UTC):	10:12:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 6478, Parent PID: 1

General

Start time (UTC):	10:12:13
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: systemd PID: 6479, Parent PID: 1

General

Start time (UTC):	10:12:13
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6479, Parent PID: 1

General

Start time (UTC):	10:12:13
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 6480, Parent PID: 1

General

Start time (UTC):	10:12:15
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd PID: 6481, Parent PID: 1

General

Start time (UTC):	10:12:15
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: generate-config PID: 6481, Parent PID: 1

General

Start time (UTC):	10:12:15
Start date (UTC):	25/12/2024
Path:	/usr/share/gdm/generate-config
Arguments:	/usr/share/gdm/generate-config
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: systemd PID: 6482, Parent PID: 1

General

Start time (UTC):	10:12:16
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: gpu-manager PID: 6482, Parent PID: 1

General

Start time (UTC):	10:12:16
Start date (UTC):	25/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	/usr/bin/gpu-manager --log /var/log/gpu-manager.log
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Chronological Activities

Analysis Process: systemd PID: 6483, Parent PID: 1

General

Start time (UTC):	10:12:16
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: plymouth PID: 6483, Parent PID: 1

General

Start time (UTC):	10:12:16
Start date (UTC):	25/12/2024
Path:	/bin/plymouth
Arguments:	/bin/plymouth quit
File size:	51352 bytes
MD5 hash:	87003efd8dad470042f5e75360a8f49f

Chronological Activities

Analysis Process: systemd PID: 6512, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd-logind PID: 6512, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/lib/systemd/systemd-logind
Arguments:	/lib/systemd/systemd-logind
File size:	268576 bytes
MD5 hash:	8dd58a1b4c12f7a1d5fe3ce18b2aaeef

Chronological Activities

Analysis Process: systemd PID: 6589, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6589, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Chronological Activities

Analysis Process: systemd PID: 6590, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: dbus-daemon PID: 6590, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/bin/dbus-daemon
Arguments:	/usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
File size:	249032 bytes
MD5 hash:	3089d47e3f3ab84cd81c48fd406d7a8c

Analysis Process: systemd PID: 6591, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd PID: 6592, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Chronological Activities

Analysis Process: systemd PID: 6593, Parent PID: 1

General

Start time (UTC):	10:13:21
Start date (UTC):	25/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may stop or disable services on a system to render those services unavailable to legitimate users. Stopping critical services or processes can inhibit or stop response to an incident or aid in the adversary's overall objectives to cause damage to the environment.
Tactics:	Impact
Data Sources:	Command: Command Execution, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Termination, Service: Service Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report byte.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Process Tree

Malware Threat Intel

Yara Signatures

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/seats/.#seat0Jp6Pal

/run/systemd/seats/.#seat0hDXvAD

/var/log/auth.log

/var/log/kern.log

/var/log/syslog

Static File Info

General

Static ELF Info

ELF header

Program Segments

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: byte.x86.elf PID: 6227, Parent PID: 6154

General

Chronological Activities

Analysis Process: byte.x86.elf PID: 6228, Parent PID: 6227

General

Chronological Activities

Analysis Process: byte.x86.elf PID: 6229, Parent PID: 6227

General

Chronological Activities

Analysis Process: byte.x86.elf PID: 6230, Parent PID: 6227

General

Linux Analysis Report
byte.x86.elf