Edit tour

Linux Analysis Report
wlw68k.elf

Overview

General Information

Sample name:	wlw68k.elf
Analysis ID:	1581702
MD5:	404cfb7607a7d6ec53599dc63ca4b591
SHA1:	6028edf8c069dedb9d1eab2190025b5494205165
SHA256:	06bd2d2ee2a9f7e6708bbc69a349696824645ab4a54c998062b509198289ec12
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581702
Start date and time:	2024-12-28 18:41:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 4s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	wlw68k.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/155@248/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
Report size exceeded maximum capacity and may have missing behavior information.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

Command:	/tmp/wlw68k.elf
PID:	6252
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	about to cum inside a femboy btw
Standard Error:

Process Tree

system is lnxubuntu20

dash New Fork (PID: 6226, Parent: 4331)

rm (PID: 6226, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ihCcDZAiN1 /tmp/tmp.MrrATgVnNX /tmp/tmp.G1kvHB4t8u

dash New Fork (PID: 6227, Parent: 4331)

rm (PID: 6227, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.ihCcDZAiN1 /tmp/tmp.MrrATgVnNX /tmp/tmp.G1kvHB4t8u

wlw68k.elf (PID: 6252, Parent: 6155, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/wlw68k.elf

wlw68k.elf New Fork (PID: 6255, Parent: 6252)

wlw68k.elf New Fork (PID: 6257, Parent: 6255)

wlw68k.elf New Fork (PID: 6399, Parent: 6257)

sh (PID: 6399, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6405, Parent: 6399)

ps (PID: 6405, Parent: 6399, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

wlw68k.elf New Fork (PID: 6910, Parent: 6257)

sh (PID: 6910, Parent: 6257, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "ps -e -o pid,args="

sh New Fork (PID: 6913, Parent: 6910)

ps (PID: 6913, Parent: 6910, MD5: ab48054475a6f70f8e7fa847331f3327) Arguments: ps -e -o pid,args=

gnome-session-binary New Fork (PID: 6259, Parent: 1477)

sh (PID: 6259, Parent: 1477, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-rfkill

gsd-rfkill (PID: 6259, Parent: 1477, MD5: 88a16a3c0aba1759358c06215ecfb5cc) Arguments: /usr/libexec/gsd-rfkill

systemd New Fork (PID: 6264, Parent: 1)

systemd-hostnamed (PID: 6264, Parent: 1, MD5: 2cc8a5576629a2d5bd98e49a4b8bef65) Arguments: /lib/systemd/systemd-hostnamed

gdm3 New Fork (PID: 6395, Parent: 1320)

Default (PID: 6395, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6396, Parent: 1320)

Default (PID: 6396, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6467, Parent: 1)

journalctl (PID: 6467, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6486, Parent: 1)

systemd-journald (PID: 6486, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6489, Parent: 1)

journalctl (PID: 6489, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --flush

systemd New Fork (PID: 6495, Parent: 1)

dbus-daemon (PID: 6495, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6505, Parent: 1860)

pulseaudio (PID: 6505, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6509, Parent: 1)

rsyslogd (PID: 6509, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6511, Parent: 1)

rtkit-daemon (PID: 6511, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6514, Parent: 1)

systemd-logind (PID: 6514, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6579, Parent: 1)

polkitd (PID: 6579, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6584, Parent: 1)

agetty (PID: 6584, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

gdm3 New Fork (PID: 6586, Parent: 1320)

Default (PID: 6586, Parent: 1320, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6587, Parent: 1)

gpu-manager (PID: 6587, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6588, Parent: 6587)

sh (PID: 6588, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6589, Parent: 6588)

grep (PID: 6589, Parent: 6588, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6590, Parent: 6587)

sh (PID: 6590, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6591, Parent: 6590)

grep (PID: 6591, Parent: 6590, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6592, Parent: 6587)

sh (PID: 6592, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6593, Parent: 6592)

grep (PID: 6593, Parent: 6592, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6594, Parent: 6587)

sh (PID: 6594, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6596, Parent: 6594)

grep (PID: 6596, Parent: 6594, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6597, Parent: 6587)

sh (PID: 6597, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6598, Parent: 6597)

grep (PID: 6598, Parent: 6597, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6599, Parent: 6587)

sh (PID: 6599, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6600, Parent: 6599)

grep (PID: 6600, Parent: 6599, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6604, Parent: 6587)

sh (PID: 6604, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6605, Parent: 6604)

grep (PID: 6605, Parent: 6604, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6606, Parent: 6587)

sh (PID: 6606, Parent: 6587, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6607, Parent: 6606)

grep (PID: 6607, Parent: 6606, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gvfsd-fuse New Fork (PID: 6608, Parent: 2038)

fusermount (PID: 6608, Parent: 2038, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 6612, Parent: 1)

generate-config (PID: 6612, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6613, Parent: 6612)

pkill (PID: 6613, Parent: 6612, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6614, Parent: 1)

gdm-wait-for-drm (PID: 6614, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6620, Parent: 1)

gdm3 (PID: 6620, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6625, Parent: 6620)

plymouth (PID: 6625, Parent: 6620, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6641, Parent: 6620)

gdm-session-worker (PID: 6641, Parent: 6620, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6647, Parent: 6641)

gdm-wayland-session (PID: 6647, Parent: 6641, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6649, Parent: 6647)

dbus-daemon (PID: 6649, Parent: 6647, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6651, Parent: 6649)

dbus-daemon New Fork (PID: 6652, Parent: 6651)

false (PID: 6652, Parent: 6651, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6653, Parent: 6647)

dbus-run-session (PID: 6653, Parent: 6647, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6654, Parent: 6653)

dbus-daemon (PID: 6654, Parent: 6653, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6655, Parent: 6620)

Default (PID: 6655, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6656, Parent: 6620)

Default (PID: 6656, Parent: 6620, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6626, Parent: 1)

accounts-daemon (PID: 6626, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6636, Parent: 6626)

language-validate (PID: 6636, Parent: 6626, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6637, Parent: 6636)

language-options (PID: 6637, Parent: 6636, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6638, Parent: 6637)

sh (PID: 6638, Parent: 6637, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6639, Parent: 6638)

locale (PID: 6639, Parent: 6638, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6640, Parent: 6638)

grep (PID: 6640, Parent: 6638, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6660, Parent: 1)

agetty (PID: 6660, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6661, Parent: 1)

rsyslogd (PID: 6661, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6663, Parent: 1)

dbus-daemon (PID: 6663, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6670, Parent: 1)

systemd-logind (PID: 6670, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6728, Parent: 1)

gpu-manager (PID: 6728, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6729, Parent: 6728)

sh (PID: 6729, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6730, Parent: 6729)

grep (PID: 6730, Parent: 6729, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6731, Parent: 6728)

sh (PID: 6731, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6732, Parent: 6731)

grep (PID: 6732, Parent: 6731, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6733, Parent: 6728)

sh (PID: 6733, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6734, Parent: 6733)

grep (PID: 6734, Parent: 6733, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6735, Parent: 6728)

sh (PID: 6735, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6736, Parent: 6735)

grep (PID: 6736, Parent: 6735, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6737, Parent: 6728)

sh (PID: 6737, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6738, Parent: 6737)

grep (PID: 6738, Parent: 6737, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6739, Parent: 6728)

sh (PID: 6739, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6740, Parent: 6739)

grep (PID: 6740, Parent: 6739, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6741, Parent: 6728)

sh (PID: 6741, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6742, Parent: 6741)

grep (PID: 6742, Parent: 6741, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6743, Parent: 6728)

sh (PID: 6743, Parent: 6728, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6744, Parent: 6743)

grep (PID: 6744, Parent: 6743, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6745, Parent: 1)

generate-config (PID: 6745, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6746, Parent: 6745)

pkill (PID: 6746, Parent: 6745, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6747, Parent: 1)

gdm-wait-for-drm (PID: 6747, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6756, Parent: 1)

rsyslogd (PID: 6756, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6764, Parent: 1)

dbus-daemon (PID: 6764, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6765, Parent: 1)

journalctl (PID: 6765, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 6766, Parent: 1)

systemd-journald (PID: 6766, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6769, Parent: 1)

systemd-logind (PID: 6769, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6826, Parent: 1)

rsyslogd (PID: 6826, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 6827, Parent: 1)

agetty (PID: 6827, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6829, Parent: 1)

dbus-daemon (PID: 6829, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6833, Parent: 1)

systemd-journald (PID: 6833, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6838, Parent: 1)

systemd-logind (PID: 6838, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6895, Parent: 1)

gpu-manager (PID: 6895, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 6896, Parent: 6895)

sh (PID: 6896, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6898, Parent: 6896)

grep (PID: 6898, Parent: 6896, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6899, Parent: 6895)

sh (PID: 6899, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6900, Parent: 6899)

grep (PID: 6900, Parent: 6899, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6901, Parent: 6895)

sh (PID: 6901, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6902, Parent: 6901)

grep (PID: 6902, Parent: 6901, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6903, Parent: 6895)

sh (PID: 6903, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6904, Parent: 6903)

grep (PID: 6904, Parent: 6903, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6905, Parent: 6895)

sh (PID: 6905, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6906, Parent: 6905)

grep (PID: 6906, Parent: 6905, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6907, Parent: 6895)

sh (PID: 6907, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6908, Parent: 6907)

grep (PID: 6908, Parent: 6907, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 6914, Parent: 6895)

sh (PID: 6914, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 6915, Parent: 6914)

grep (PID: 6915, Parent: 6914, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 6917, Parent: 6895)

sh (PID: 6917, Parent: 6895, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 6918, Parent: 6917)

grep (PID: 6918, Parent: 6917, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 6921, Parent: 1)

generate-config (PID: 6921, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 6922, Parent: 6921)

pkill (PID: 6922, Parent: 6921, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 6923, Parent: 1)

gdm-wait-for-drm (PID: 6923, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 6928, Parent: 1)

gdm3 (PID: 6928, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 6931, Parent: 6928)

plymouth (PID: 6931, Parent: 6928, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 6947, Parent: 6928)

gdm-session-worker (PID: 6947, Parent: 6928, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 6951, Parent: 6947)

gdm-wayland-session (PID: 6951, Parent: 6947, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 6953, Parent: 6951)

dbus-daemon (PID: 6953, Parent: 6951, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 6955, Parent: 6953)

dbus-daemon New Fork (PID: 6956, Parent: 6955)

false (PID: 6956, Parent: 6955, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 6957, Parent: 6951)

dbus-run-session (PID: 6957, Parent: 6951, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 6958, Parent: 6957)

dbus-daemon (PID: 6958, Parent: 6957, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 6959, Parent: 6928)

Default (PID: 6959, Parent: 6928, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 6960, Parent: 6928)

Default (PID: 6960, Parent: 6928, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 6932, Parent: 1)

accounts-daemon (PID: 6932, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 6936, Parent: 6932)

language-validate (PID: 6936, Parent: 6932, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 6937, Parent: 6936)

language-options (PID: 6937, Parent: 6936, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 6938, Parent: 6937)

sh (PID: 6938, Parent: 6937, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 6939, Parent: 6938)

locale (PID: 6939, Parent: 6938, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 6940, Parent: 6938)

grep (PID: 6940, Parent: 6938, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 6941, Parent: 1)

polkitd (PID: 6941, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 6976, Parent: 1860)

dbus-daemon (PID: 6976, Parent: 1860, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6977, Parent: 1860)

pulseaudio (PID: 6977, Parent: 1860, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 6978, Parent: 1)

rtkit-daemon (PID: 6978, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

systemd New Fork (PID: 6979, Parent: 1)

agetty (PID: 6979, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 6980, Parent: 1)

dbus-daemon (PID: 6980, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 6981, Parent: 1)

systemd-journald (PID: 6981, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 6984, Parent: 1)

systemd-logind (PID: 6984, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 6992, Parent: 1)

rsyslogd (PID: 6992, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7025, Parent: 1)

agetty (PID: 7025, Parent: 1, MD5: 3a374724ba7e863768139bdd60ca36f7) Arguments: /sbin/agetty -o "-p -- \\u" --noclear tty2 linux

systemd New Fork (PID: 7031, Parent: 1)

dbus-daemon (PID: 7031, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7047, Parent: 1)

rsyslogd (PID: 7047, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 7052, Parent: 1)

gpu-manager (PID: 7052, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 7053, Parent: 7052)

sh (PID: 7053, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7054, Parent: 7053)

grep (PID: 7054, Parent: 7053, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7055, Parent: 7052)

sh (PID: 7055, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7056, Parent: 7055)

grep (PID: 7056, Parent: 7055, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7057, Parent: 7052)

sh (PID: 7057, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7058, Parent: 7057)

grep (PID: 7058, Parent: 7057, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7059, Parent: 7052)

sh (PID: 7059, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7061, Parent: 7059)

grep (PID: 7061, Parent: 7059, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7065, Parent: 7052)

sh (PID: 7065, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7066, Parent: 7065)

grep (PID: 7066, Parent: 7065, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7068, Parent: 7052)

sh (PID: 7068, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7069, Parent: 7068)

grep (PID: 7069, Parent: 7068, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 7070, Parent: 7052)

sh (PID: 7070, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 7071, Parent: 7070)

grep (PID: 7071, Parent: 7070, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 7072, Parent: 7052)

sh (PID: 7072, Parent: 7052, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nouveau[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 7073, Parent: 7072)

grep (PID: 7073, Parent: 7072, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nouveau[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 7074, Parent: 1)

generate-config (PID: 7074, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 7075, Parent: 7074)

pkill (PID: 7075, Parent: 7074, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 7078, Parent: 1)

gdm-wait-for-drm (PID: 7078, Parent: 1, MD5: 82043ba752c6930b4e6aaea2f7747545) Arguments: /usr/lib/gdm3/gdm-wait-for-drm

systemd New Fork (PID: 7083, Parent: 1)

gdm3 (PID: 7083, Parent: 1, MD5: 2492e2d8d34f9377e3e530a61a15674f) Arguments: /usr/sbin/gdm3

gdm3 New Fork (PID: 7086, Parent: 7083)

plymouth (PID: 7086, Parent: 7083, MD5: 87003efd8dad470042f5e75360a8f49f) Arguments: plymouth --ping

gdm3 New Fork (PID: 7100, Parent: 7083)

gdm-session-worker (PID: 7100, Parent: 7083, MD5: 692243754bd9f38fe9bd7e230b5c060a) Arguments: "gdm-session-worker [pam/gdm-launch-environment]"

gdm-session-worker New Fork (PID: 7108, Parent: 7100)

gdm-wayland-session (PID: 7108, Parent: 7100, MD5: d3def63cf1e83f7fb8a0f13b1744ff7c) Arguments: /usr/lib/gdm3/gdm-wayland-session "dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart"

gdm-wayland-session New Fork (PID: 7110, Parent: 7108)

dbus-daemon (PID: 7110, Parent: 7108, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --print-address 3 --session

dbus-daemon New Fork (PID: 7114, Parent: 7110)

dbus-daemon New Fork (PID: 7115, Parent: 7114)

false (PID: 7115, Parent: 7114, MD5: 3177546c74e4f0062909eae43d948bfc) Arguments: /bin/false

gdm-wayland-session New Fork (PID: 7116, Parent: 7108)

dbus-run-session (PID: 7116, Parent: 7108, MD5: 245f3ef6a268850b33b0225a8753b7f4) Arguments: dbus-run-session -- gnome-session --autostart /usr/share/gdm/greeter/autostart

dbus-run-session New Fork (PID: 7117, Parent: 7116)

dbus-daemon (PID: 7117, Parent: 7116, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: dbus-daemon --nofork --print-address 4 --session

gdm3 New Fork (PID: 7119, Parent: 7083)

Default (PID: 7119, Parent: 7083, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 7122, Parent: 7083)

Default (PID: 7122, Parent: 7083, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 7087, Parent: 1)

accounts-daemon (PID: 7087, Parent: 1, MD5: 01a899e3fb5e7e434bea1290255a1f30) Arguments: /usr/lib/accountsservice/accounts-daemon

accounts-daemon New Fork (PID: 7091, Parent: 7087)

language-validate (PID: 7091, Parent: 7087, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/language-tools/language-validate en_US.UTF-8

language-validate New Fork (PID: 7092, Parent: 7091)

language-options (PID: 7092, Parent: 7091, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/share/language-tools/language-options

language-options New Fork (PID: 7093, Parent: 7092)

sh (PID: 7093, Parent: 7092, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "locale -a | grep -F .utf8 "

sh New Fork (PID: 7094, Parent: 7093)

locale (PID: 7094, Parent: 7093, MD5: c72a78792469db86d91369c9057f20d2) Arguments: locale -a

sh New Fork (PID: 7095, Parent: 7093)

grep (PID: 7095, Parent: 7093, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -F .utf8

systemd New Fork (PID: 7096, Parent: 1)

polkitd (PID: 7096, Parent: 1, MD5: 8efc9b4b5b524210ad2ea1954a9d0e69) Arguments: /usr/lib/policykit-1/polkitd --no-debug

systemd New Fork (PID: 7106, Parent: 1)

systemd (PID: 7106, Parent: 1, MD5: 9b2bec7092a40488108543f9334aab75) Arguments: /lib/systemd/systemd --user

systemd New Fork (PID: 7111, Parent: 7106)

systemd New Fork (PID: 7112, Parent: 7111)

30-systemd-environment-d-generator (PID: 7112, Parent: 7111, MD5: 42417da8051ba8ee0eea7854c62d99ca) Arguments: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator

systemd New Fork (PID: 7123, Parent: 7106)

systemctl (PID: 7123, Parent: 7106, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

systemd New Fork (PID: 7124, Parent: 7106)

pulseaudio (PID: 7124, Parent: 7106, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

systemd New Fork (PID: 7132, Parent: 7106)

dbus-daemon (PID: 7132, Parent: 7106, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 7125, Parent: 1)

rtkit-daemon (PID: 7125, Parent: 1, MD5: df0cacf1db4ec95ac70f5b6e06b8ffd7) Arguments: /usr/libexec/rtkit-daemon

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
wlw68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
wlw68k.elf	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x247a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2480a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2481e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24832:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24846:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2485a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2486e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24882:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24896:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2490e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24922:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24936:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

Memory Dumps

Source	Rule	Description	Author	Strings
6252.1.00007ff430001000.00007ff430029000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6252.1.00007ff430001000.00007ff430029000.r-x.sdmp	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x247a6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247ba:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247ce:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247e2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x247f6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2480a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2481e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24832:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24846:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2485a:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2486e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24882:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24896:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248aa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248be:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248d2:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248e6:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x248fa:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x2490e:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24922:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x24936:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F
Process Memory Space: wlw68k.elf PID: 6252	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: wlw68k.elf PID: 6252	Linux_Trojan_Gafgyt_28a2fe0c	unknown	unknown	0x70f1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7105:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7119:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x712d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7141:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7155:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7169:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x717d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7191:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71a5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71b9:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71cd:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71e1:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x71f5:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7209:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x721d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7231:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7245:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7259:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x726d:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F 0x7281:$a: 2F 78 33 38 2F 78 46 4A 2F 78 39 33 2F 78 49 44 2F 78 39 41 2F 78 33 38 2F 78 46 4A 2F

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Source: /usr/sbin/rsyslogd (PID: 6509)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6661)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6756)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 6826)	Reads hosts file: /etc/hosts
Source: /usr/sbin/rsyslogd (PID: 7047)	Reads hosts file: /etc/hosts

Source: /lib/systemd/systemd-journald (PID: 6486)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6620)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6649)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6766)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6833)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 6928)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 6953)	Socket: unknown address family
Source: /lib/systemd/systemd-journald (PID: 6981)	Socket: unknown address family
Source: /usr/sbin/gdm3 (PID: 7083)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7110)	Socket: unknown address family
Source: /usr/bin/dbus-daemon (PID: 7117)	Socket: unknown address family
Source: /lib/systemd/systemd (PID: 7106)	Socket: unknown address family

Source: unknown	TCP traffic detected without corresponding DNS query: 54.171.230.55
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru
Source: global traffic	DNS traffic detected: DNS query: raw.cardiacpure.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.136.dr, syslog.186.dr, syslog.198.dr, syslog.45.dr, syslog.309.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 33606
Source: unknown	Network traffic detected: HTTP traffic on port 33606 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53842
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: wlw68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6252.1.00007ff430001000.00007ff430029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: wlw68k.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6259, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4403, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4404, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4484, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4490, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4511, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 5904, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6060, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6109, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6180, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6188, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6208, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6217, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6218, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6405, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6505, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6620, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6660, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6661, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6753, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6486, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6670, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6756, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6761, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6762, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6764, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6766, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6769, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6217, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6218, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6505, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6826, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6827, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6829, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6833, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6838, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6910, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6913, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6928, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6976, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6977, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6979, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6980, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6992, result: successful	Jump to behavior

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Source: ELF static info symbol of initial sample

.symtab present: no

Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6259, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1983, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4403, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4404, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4447, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4479, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4484, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4490, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 4511, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 5904, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6060, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6109, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6180, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6188, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6208, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6217, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6218, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6238, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6239, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6240, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6241, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6242, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6243, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6244, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6245, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6264, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6397, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6398, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6399, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6405, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6495, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6505, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6509, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6620, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6659, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6660, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6661, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6663, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6752, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6753, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6753, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6486, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6670, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6747, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6756, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6761, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6762, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6764, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6766, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6769, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1334, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 1335, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6217, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6218, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6505, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6826, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6827, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6828, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6829, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6833, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6838, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6910, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6913, result: no such process	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6928, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6976, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6977, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6979, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6980, result: successful	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	SIGKILL sent: pid: 6992, result: successful	Jump to behavior

Source: wlw68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6252.1.00007ff430001000.00007ff430029000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: wlw68k.elf PID: 6252, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/155@248/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6495)	File: /proc/6495/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6608)	File: /proc/6608/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6649)	File: /proc/6649/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6654)	File: /proc/6654/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6663)	File: /proc/6663/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6764)	File: /proc/6764/mounts
Source: /usr/bin/dbus-daemon (PID: 6829)	File: /proc/6829/mounts
Source: /usr/bin/dbus-daemon (PID: 6953)	File: /proc/6953/mounts
Source: /usr/bin/dbus-daemon (PID: 6958)	File: /proc/6958/mounts
Source: /usr/bin/dbus-daemon (PID: 6976)	File: /proc/6976/mounts
Source: /usr/bin/dbus-daemon (PID: 7031)	File: /proc/7031/mounts
Source: /usr/bin/dbus-daemon (PID: 7110)	File: /proc/7110/mounts
Source: /usr/bin/dbus-daemon (PID: 7117)	File: /proc/7117/mounts
Source: /usr/bin/dbus-daemon (PID: 7132)	File: /proc/7132/mounts

Source: /usr/libexec/gsd-rfkill (PID: 6259)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6259)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6264)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:76501XxRjPB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:76502PuoX8C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:75527okAUGE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:755436VFyyC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:75547EwFgjD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:756229N8DBF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:75623QlsciD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:756510qbYYF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:7571832NHrC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:77991ZLQ62D	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78080RnuTpF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78090nKNqaC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78183C86IeC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78217ZKyUTF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78268zol90C	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78270eI3MzB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:77808OR85FB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:77810ic8JoC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78943QNFzvB	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:78970KAZjlC	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:789870UmSCE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:79024zHYK2B	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:79049AwQCfD	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:79070UBPkvE	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:79124xSQdsF	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:803067bse3B	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	File: /run/systemd/journal/streams/.#9:80320oW4SnF	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	File: /run/systemd/seats/.#seat0BNb1OL	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	File: /run/systemd/users/.#127DC87aJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	File: /run/systemd/users/.#127nSAYaJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	File: /run/systemd/seats/.#seat0trHG3J	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	File: /run/systemd/users/.#127jS1zHK	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6514)	File: /run/systemd/users/.#127HKzWWI	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6579)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6647)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6626)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6626)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6670)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6670)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6670)	File: /run/systemd/seats/.#seat0Mcx9Ix	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6769)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6769)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6769)	File: /run/systemd/seats/.#seat06xnQR1
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81041H6KYJT
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81048MYpewQ
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81049VYooVT
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81050ruzLER
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81063LfejIT
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81064bOZ1YT
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:810653ThJgR
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81147JaDeXT
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81247gn1J9R
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:81332jtr14S
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:79813b7kTJR
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:79839McUxkT
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:79840tZ6mvQ
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:79870vmmp1R
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:79871WkOULU
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:82282rCZJgU
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:822955Du64S
Source: /lib/systemd/systemd-journald (PID: 6833)	File: /run/systemd/journal/streams/.#9:82308YxJXmT
Source: /lib/systemd/systemd-logind (PID: 6838)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6838)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6838)	File: /run/systemd/seats/.#seat0gKZ0Uf
Source: /lib/systemd/systemd-logind (PID: 6838)	File: /run/systemd/users/.#127C1WnSf
Source: /lib/systemd/systemd-logind (PID: 6838)	File: /run/systemd/users/.#127BRZqSe
Source: /lib/systemd/systemd-logind (PID: 6838)	File: /run/systemd/seats/.#seat0mhlnsh
Source: /lib/systemd/systemd-logind (PID: 6838)	File: /run/systemd/users/.#127zDghKg
Source: /lib/systemd/systemd-logind (PID: 6838)	File: /run/systemd/users/.#127nYRS2h
Source: /lib/systemd/systemd-logind (PID: 6838)	File: /run/systemd/users/.#127ZBYiYe
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6951)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6932)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6932)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 6941)	Directory: /root/.cache
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912650JnDus6
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912651ERO273
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912652nSqSq4
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912653Z4utJ3
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912654kM98T5
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912663sbr5E3
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912670zIMpP4
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:9127568qpAd4
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912887S87OU4
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:912984cMFhL2
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:24973843pvWy5
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:2470117UwBTQ4
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:2470119aGBqi5
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:247025310AHI6
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:2470266Aqvm72
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:2470268CGQjM2
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:24704590rJDT3
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:2470508ZEwrp2
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:2470616iXLUz4
Source: /lib/systemd/systemd-journald (PID: 6981)	File: /run/systemd/journal/streams/.#9:2470774idFGW4
Source: /lib/systemd/systemd-logind (PID: 6984)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd-logind (PID: 6984)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/seats/.#seat0Ik7ETj
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/users/.#127O8LgDj
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/users/.#127CNh6hg
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/seats/.#seat0swijBh
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/users/.#1274YLCfk
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/users/.#127QXWEij
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/users/.#1273GiVrj
Source: /lib/systemd/systemd-logind (PID: 6984)	File: /run/systemd/users/.#1274vSwfh
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 7108)	Directory: /var/lib/gdm3/.cache
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7087)	Directory: /var/lib/gdm3/.pam_environment
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7087)	Directory: /root/.cache
Source: /usr/lib/policykit-1/polkitd (PID: 7096)	Directory: /root/.cache
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (15)>/..
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (14)>/..
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (17)>/..
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (19)>/..
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (18)>/..
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (23)>/..
Source: /lib/systemd/systemd (PID: 7106)	Directory: <invalid fd (22)>/..
Source: /usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator (PID: 7112)	Directory: <invalid fd (4)>/.config

Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6495/status	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6495/attr/current	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6641/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6641/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6511/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/1809/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6620/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6579/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6504/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6504/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6647/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6514/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6505/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6505/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6505/cmdline	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6495)	File opened: /proc/6626/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1335/fd	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1334/fd	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6257)	File opened: /proc/2302/cmdline	Jump to behavior

Source: /tmp/wlw68k.elf (PID: 6399)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /tmp/wlw68k.elf (PID: 6910)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6588)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6590)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6592)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6594)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6597)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6599)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6604)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6606)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6638)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6729)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6731)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6733)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6735)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6737)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6739)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6741)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6743)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6896)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6899)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6901)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6903)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6905)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6907)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6914)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 6917)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 6938)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "
Source: /usr/bin/gpu-manager (PID: 7053)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7055)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7057)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7059)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7065)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7068)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7070)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"
Source: /usr/bin/gpu-manager (PID: 7072)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"
Source: /usr/share/language-tools/language-options (PID: 7093)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "

Source: /bin/sh (PID: 6589)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6591)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6593)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6598)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6600)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6605)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6607)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6640)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6730)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6732)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6734)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6736)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6738)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6740)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6742)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6744)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6898)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6900)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6902)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6904)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6906)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6908)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6915)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 6918)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 6940)	Grep executable: /usr/bin/grep -> grep -F .utf8
Source: /bin/sh (PID: 7054)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7056)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7058)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7061)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7066)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7069)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7071)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf
Source: /bin/sh (PID: 7073)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf
Source: /bin/sh (PID: 7095)	Grep executable: /usr/bin/grep -> grep -F .utf8

Source: /usr/share/gdm/generate-config (PID: 6613)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6746)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6922)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service
Source: /usr/share/gdm/generate-config (PID: 7075)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service

Source: /bin/sh (PID: 6405)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior
Source: /bin/sh (PID: 6913)	Ps executable: /usr/bin/ps -> ps -e -o pid,args=			Jump to behavior

Source: /usr/bin/dash (PID: 6226)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ihCcDZAiN1 /tmp/tmp.MrrATgVnNX /tmp/tmp.G1kvHB4t8u			Jump to behavior
Source: /usr/bin/dash (PID: 6227)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.ihCcDZAiN1 /tmp/tmp.MrrATgVnNX /tmp/tmp.G1kvHB4t8u			Jump to behavior

Source: /lib/systemd/systemd (PID: 7123)

Systemctl executable: /bin/systemctl -> /bin/systemctl --user set-environment DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/127/bus

Source: /usr/bin/ps (PID: 6405)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /usr/bin/ps (PID: 6913)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6766)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6833)	Reads from proc file: /proc/meminfo
Source: /lib/systemd/systemd-journald (PID: 6981)	Reads from proc file: /proc/meminfo

Source: /sbin/agetty (PID: 6584)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6660)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6827)	Reads version info: /etc/issue
Source: /sbin/agetty (PID: 7025)	Reads version info: /etc/issue

Source: /usr/sbin/gdm3 (PID: 6620)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6620)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6626)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6626)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6928)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 6928)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6932)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6932)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)
Source: /usr/sbin/gdm3 (PID: 7083)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/sbin/gdm3 (PID: 7083)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7087)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7087)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)

Source: /usr/sbin/rsyslogd (PID: 6509)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6509)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6587)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6661)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6661)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6728)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6756)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6826)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6826)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6895)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 7047)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 7047)	Log file created: /var/log/auth.log	Jump to dropped file
Source: /usr/bin/gpu-manager (PID: 7052)	Log file created: /var/log/gpu-manager.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/wlw68k.elf (PID: 6255)

File: /tmp/wlw68k.elf

Jump to behavior

Source: /usr/bin/gpu-manager (PID: 6587)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6728)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6895)	Truncated file: /var/log/gpu-manager.log
Source: /usr/bin/gpu-manager (PID: 7052)	Truncated file: /var/log/gpu-manager.log

Source: /usr/bin/ps (PID: 6405)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/ps (PID: 6913)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6505)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6613)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6746)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6922)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 7075)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pulseaudio (PID: 7124)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/wlw68k.elf (PID: 6252)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6264)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6486)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6505)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6509)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6584)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6587)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6641)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6660)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6661)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6728)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6756)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6766)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 6826)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 6827)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6833)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 6895)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6947)	Queries kernel information via 'uname':
Source: /lib/systemd/systemd-journald (PID: 6981)	Queries kernel information via 'uname':
Source: /sbin/agetty (PID: 7025)	Queries kernel information via 'uname':
Source: /usr/sbin/rsyslogd (PID: 7047)	Queries kernel information via 'uname':
Source: /usr/bin/gpu-manager (PID: 7052)	Queries kernel information via 'uname':
Source: /usr/lib/gdm3/gdm-session-worker (PID: 7100)	Queries kernel information via 'uname':
Source: /usr/bin/pulseaudio (PID: 7124)	Queries kernel information via 'uname':

Source: kern.log.309.dr	Binary or memory string: Dec 28 11:44:45 galassia kernel: [ 590.381869] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: wlw68k.elf, 6252.1.00007ffe47097000.00007ffe470b8000.rw-.sdmp	Binary or memory string: /qemu-open.XXXXX
Source: kern.log.309.dr	Binary or memory string: Dec 28 11:44:45 galassia kernel: [ 590.381900] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: wlw68k.elf, 6252.1.00007ffe47097000.00007ffe470b8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: wlw68k.elf, 6252.1.00007ffe47097000.00007ffe470b8000.rw-.sdmp	Binary or memory string: (*;V/tmp/qemu-open.xHu8uW\
Source: wlw68k.elf, 6252.1.0000563b2cc44000.0000563b2ccc9000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k
Source: wlw68k.elf, 6252.1.00007ffe47097000.00007ffe470b8000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.xHu8uW
Source: wlw68k.elf, 6252.1.00007ffe47097000.00007ffe470b8000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/wlw68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/wlw68k.elf
Source: wlw68k.elf, 6252.1.0000563b2cc44000.0000563b2ccc9000.rw-.sdmp	Binary or memory string: ,;V!/etc/qemu-binfmt/m68k

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6626)	Logged in records file read: /var/log/wtmp	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6932)	Logged in records file read: /var/log/wtmp
Source: /usr/lib/accountsservice/accounts-daemon (PID: 7087)	Logged in records file read: /var/log/wtmp

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: wlw68k.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007ff430001000.00007ff430029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wlw68k.elf PID: 6252, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: wlw68k.elf, type: SAMPLE
Source: Yara match	File source: 6252.1.00007ff430001000.00007ff430029000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: wlw68k.elf PID: 6252, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	1 Systemd Service	1 Systemd Service	1 File and Directory Permissions Modification	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	2 Scripting	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Hidden Files and Directories	Security Account Manager	1 System Owner/User Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Indicator Removal	NTDS	11 File and Directory Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	11 File Deletion	LSA Secrets	3 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
wlw68k.elf	39%	ReversingLabs	Linux.Backdoor.Mirai
wlw68k.elf	100%	Avira	EXP/ELF.Mirai.Z.A

Name	IP	Active	Malicious	Reputation
daisy.ubuntu.com	162.213.35.24	true	false	high
raw.cardiacpure.ru	178.215.238.153	true	false	high
raw.cardiacpure.ru. [malformed]	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.rsyslog.com	syslog.136.dr, syslog.186.dr, syslog.198.dr, syslog.45.dr, syslog.309.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.171.230.55	unknown	United States	16509	AMAZON-02US	false
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
178.215.238.153	raw.cardiacpure.ru	Germany	10753	LVLT-10753US	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.171.230.55	nshkarm5.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Gafgyt	Browse
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	byte.ppc.elf	Get hash	malicious	Mirai, Okiru	Browse
	.i.elf	Get hash	malicious	Unknown	Browse
	sh4.nn.elf	Get hash	malicious	Okiru	Browse
	mipsel.nn.elf	Get hash	malicious	Okiru	Browse
	feiwbps.elf	Get hash	malicious	Mirai	Browse
162.213.35.25	x86_64.elf	Get hash	malicious	Gafgyt	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse
	wiewa64.elf	Get hash	malicious	Mirai	Browse
	wrjkngh4.elf	Get hash	malicious	Mirai	Browse
	vwkjebwi686.elf	Get hash	malicious	Mirai	Browse
	dwhdbg.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm7.elf	Get hash	malicious	Mirai	Browse
	wnbw86.elf	Get hash	malicious	Mirai	Browse
	Aqua.x86_64.elf	Get hash	malicious	Mirai	Browse
	Aqua.arm5.elf	Get hash	malicious	Mirai	Browse
178.215.238.153	njvwa4.elf	Get hash	malicious	Mirai	Browse
89.190.156.145	njvwa4.elf	Get hash	malicious	Mirai	Browse
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
daisy.ubuntu.com	arm7.elf	Get hash	malicious	Unknown	Browse	162.213.35.25
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	yakuza.arm6.elf	Get hash	malicious	Mirai	Browse	162.213.35.25
	yakuza.x86.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i586.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	yakuza.i686.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	arm6.elf	Get hash	malicious	Gafgyt	Browse	162.213.35.24
	45.200.149.186-boatnet.arm-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	162.213.35.24
	byte.x86.elf	Get hash	malicious	Mirai, Okiru	Browse	162.213.35.25
raw.cardiacpure.ru	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
raw.cardiacpure.ru	gnjqwpc.elf	Get hash	malicious	Mirai	Browse	178.215.238.25

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
HOSTUS-GLOBAL-ASHostUSHK	njvwa4.elf	Get hash	malicious	Mirai	Browse	89.190.156.145
	Aqua.spc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.ppc.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.x86.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.dbg.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.mpsl.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.arm5.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.arm4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.sh4.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
	Aqua.m68k.elf	Get hash	malicious	Unknown	Browse	89.190.156.145
LVLT-10753US	njvwa4.elf	Get hash	malicious	Mirai	Browse	178.215.238.153
	feiwbps.elf	Get hash	malicious	Mirai	Browse	178.215.238.25
	kitsune.arm4.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.sparc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.arm7.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.x86.elf	Get hash	malicious	Mirai, Gafgyt	Browse	178.215.238.69
	kitsune.arm6.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
	kitsune.ppc.elf	Get hash	malicious	Gafgyt, Mirai	Browse	178.215.238.69
AMAZON-02US	nshkarm5.elf	Get hash	malicious	Unknown	Browse	54.171.230.55
	https://app.slintel-privacy.com/links/J95tSop4o/SS6JytVVw/qm84IUL58/GFC-9kqk1-	Get hash	malicious	Unknown	Browse	3.109.113.207
	http://prowebideas.com/dsfdgfhgdfsdfdgfhgdrwet/gdfsdfdgfhgfgdfsdfdgfh/gfsdfdgfhgfgdfsdfdgfhgdfsdfdgfh	Get hash	malicious	Unknown	Browse	44.237.4.100
	arm6.elf	Get hash	malicious	Gafgyt	Browse	54.171.230.55
	yakuza.arm4.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	54.171.230.55
	https://haleborealis.com	Get hash	malicious	Unknown	Browse	108.158.75.126
	https://www.dropbox.com/scl/fi/lncgsm76k7l5ix7fuu5t6/2024-OK-House-Outreach.pdf?rlkey=o4qr50zpdw1z14o6ikdg6zjt8&st=lrloyzlo&dl=0	Get hash	malicious	Unknown	Browse	34.249.87.52
	https://fin.hiringplatform.ca/processes/197662-tax-legislation-officer-ec-06-ec-07?locale=en	Get hash	malicious	Unknown	Browse	52.222.144.19
	http://resources.onestart.ai/onestart_installer_130.0.6723.134.exe	Get hash	malicious	Unknown	Browse	3.160.196.100
CANONICAL-ASGB	woega6.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	nshkarm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	yakuza.mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	yakuza.arm5.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	arm5.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.9219280948873623
Encrypted:	false
SSDEEP:	3:5bkPn:pkP
MD5:	FF001A15CE15CF062A3704CEA2991B5F
SHA1:	B06F6855F376C3245B82212AC73ADED55DFE5DEF
SHA-256:	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
SHA-512:	65EBF7C31F6F65713CE01B38A112E97D0AE64A6BD1DA40CE4C1B998F10CD3912EE1A48BB2B279B24493062118AAB3B8753742E2AF28E56A31A7AAB27DE80E7BF
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	18
Entropy (8bit):	3.4613201402110088
Encrypted:	false
SSDEEP:	3:5bkrIZsXvn:pkckv
MD5:	28FE6435F34B3367707BB1C5D5F6B430
SHA1:	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6
SHA-256:	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
SHA-512:	6B6AB7C0979629D0FEF6BE47C5C6BCC367EDD0AAE3FC973F4DE2FD5F0A819C89E7656DB65D453B1B5398E54012B27EDFE02894AD87A7E0AF3A9C5F2EB24A9919
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	auto_null.monitor.

/memfd:30-systemd-environment-d-generator (deleted)

Download File

Process:	/usr/lib/systemd/user-environment-generators/30-systemd-environment-d-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	200
Entropy (8bit):	4.621490641385995
Encrypted:	false
SSDEEP:	3:+2snsY7+4VMPQnMLmPQ9JEcn8YLw6mNErZwb906izhs32Y0f/KiDXK/vi++BLiVv:Ess+4m4Mixc8Y06me6osMjDXj++yvn
MD5:	5EF9649F7C218F464C253BDC1549C046
SHA1:	07C3B1103F09E5FB0B4701E75E326D55D4FC570B
SHA-256:	B4480A805024063034CB27A4A70BCA625C46C98963A39FE18F9BE2C499F1DA40
SHA-512:	DF620669CD92538F00FEB397BA8BB0C0DC9E242BA2A3F25561DE20AE59B73AC54A15DBFBD4C43F8006FA09D0A07D9EC5DD5D395AD4746E022A17E78274DEB83B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	QT_ACCESSIBILITY=1.PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/memfd:user-environment-generators (deleted)

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	212
Entropy (8bit):	4.657790370557215
Encrypted:	false
SSDEEP:	6:ulsT4m4Mixc8Y06me6kLT0QsMjDXj++yvn:XT5ikXT05OLj+Hvn
MD5:	769AC00395ABDA061DA4777C87620B21
SHA1:	AC12A8E0EB413395C64577FA7E514626B8F8F548
SHA-256:	75867CD2977A9A9AAB70E70CFEE3C20151F31C9B3CBDA4A81C06627C291D2C82
SHA-512:	67C2B17CDD15B7F69BE2DF4F3136E3F393C1C6F990755DFEEC1B0B4E1081A15132A8D77A1624CAD1F6255591AE54CB9135F1B94FE31D5876E2A17B215CDB78F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	env=QT_ACCESSIBILITY=1.env=PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin:/snap/bin.env=XDG_DATA_DIRS=/usr/local/share/:/usr/share/:/var/lib/snapd/desktop.

/proc/6652/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Reputation:	high, very likely benign file
Preview:	0

/proc/6956/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/proc/7115/oom_score_adj

Download File

Process:	/usr/bin/dbus-daemon
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	CFCD208495D565EF66E7DFF9F98764DA
SHA1:	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C
SHA-256:	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
SHA-512:	31BCA02094EB78126A517B206A88C73CFA9EC6F704C7030D18212CACE820F025F00BF0EA68DBF3F3A5436CA63B53BF7BF80AD8D5DE7D8359D0B7FED9DBC3AB99
Malicious:	false
Preview:	0

/run/gdm3.pid

Download File

Process:	/usr/sbin/gdm3
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:mdon:m2n
MD5:	7FF0791DD2B561FA26190BFD1E855CD9
SHA1:	AA17C6AC063165A099067FD21B65DA3CE3B01DE2
SHA-256:	895784282C2B64E5ED655F6E0B1ABA71A9D97BB9125E7143A19740B729A71763
SHA-512:	98ADC18829773CCEEDE2A1FAB5695992433FDD22F2F01A8A52644E9E75A494D07B6C797106F9D9D53B4A4F6F741861D67762442BD23562135240A0A969A03367
Malicious:	false
Preview:	7083.

/run/systemd/journal/streams/.#9:2470117UwBTQ4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.439314926861828
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm56AUrQJUBESg2jk:SbFuFyLVK6g7/+BG+f+MhWQJQTjNq
MD5:	7BB0150F3A67D6CCBB76ECAAD7161F20
SHA1:	1DF7125CA6ED93C5D2B74838D1920A354A936088
SHA-256:	1323271FC55B95FBF8292F9163A9A9D2465A8E2CF15AE24976105B2E64F54F4B
SHA-512:	2B8237719602473AE868141C860144A453D2FB67B170D533F44E8F1612476BCC95D1734BF0702C9409BFF3129DA264007D53082EC0BF9B260D0A92A49338478B
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3375f0644f284e149e5f2596615b7dad.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:2470119aGBqi5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.412632345124922
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmzjScjfEH3pbsMqQ:SbFuFyLVI6g7/+BG+f+M3vWpQjNq
MD5:	D9004046C355E2F051D8B617E6E6CB12
SHA1:	3ABBAD5E3D95FC31BE61A93B6A1F4F0539B56135
SHA-256:	56F4269FC98358EE864D133C20FE2533404606BCEFBC78CCB2968C3077657657
SHA-512:	7699B5146D91242077653DF46A3A2A6BD044056C8B5C8CD363821E5DBFB30D1B8A3F7347F5DFA6B11CFF2C233DD3C059231FC016AD8310C3EEEDC2C780B97BC8
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90f69979754149a08fc62907cfae5ab8.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:247025310AHI6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.421043824630439
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuvxNQfrzsh+sjsicX:SbFuFyLVIg1BG+f+MuvQz4jZcHBrt
MD5:	EFC2BA1F999098C6A48DF4D06EC5E42E
SHA1:	4E782ABC81D8EF33E086C7A329A196A759FE7F59
SHA-256:	8D3EE83FF7AC2BA9DB6E5DF383F54CF900A53EC4050C3BF442328D6A99B73F15
SHA-512:	71B759D11444D4CA18FBBAC29E581C296E2E6E3F15BA41F5BFD0E7F339220798F8ECD1339ECE37A2BCDF7E3424FC4FB988B5ADF8E2CCDFF918D78195429E9842
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d4732e7ccbbf4835aca04184b51cd853.IDENTIFIER=systemd.UNIT=user@127.service.

/run/systemd/journal/streams/.#9:2470266Aqvm72

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.491963863361303
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+M4eIDEUn0jFQMzKaBu:qgFqo6g7/+0+f+M4eIETmh
MD5:	35D93D8DABA11EC1772DB0BF38DFBF96
SHA1:	445D77500AA5FC415AFB83A5A4D9E316258E76E6
SHA-256:	081343C347C86979AB4F3D1044D0D37FA41F01EEE39572D5EEE7D47284E7D718
SHA-512:	E28676E32395804EECC769FD152D9373ECDF59B561A6D1C7ACCC34869BEE7C7E8735F7C85CFEEAC579EEF4F7647A828CC6C293247510D0AF769F05E3723F0D0A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2677bce2497249f9a2968a7a6b1a1aa0.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:2470268CGQjM2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.5008791884748405
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MNPBUS6ak5qjFQMzKaBu:qgFqdg7/+0+f+MNO+Tmh
MD5:	2934985B8650763EB599DB40BBA80C7E
SHA1:	F6DF6C0D8BE353C3735FBFF0B7607265122C4FA1
SHA-256:	F23CC5398A1065CC5B409BCF3603ED292EECA8CDD1D7D30EA00F176506B9E0A2
SHA-512:	A9B0D1C6B3CEB6B68197D5ADD082AD425F958B09F3F5CCBAD9512CB69F0E773002D1CF005E2F279198C156115C150A6EF7F878FE7B2D2E7CBEBCC8751F9944E1
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1faad9f69ca246c2bf7496245ea0e54a.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:24704590rJDT3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	187
Entropy (8bit):	5.388959163757768
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsgFfJG3Av8jsicWmT:SbFuFyLVIg1BG+f+MsgO3pjZcHjv
MD5:	BEFF5CB12622B4CA30153C8057D261B4
SHA1:	A9157A6F819B22C62970C577543D45B16C0319FB
SHA-256:	1E913B507A06A8BA89EDB1F6561023578DD151133B47A9F2561C668C83C77E95
SHA-512:	8E77AA6293D0B05E8EFA02930F80D93BCFB4259EC77E3CD66E19EE433CF4C018EB495CB91BBEB1A1797A26CA4BFF5A11C30D7C8E329295AD5199ECC2C8002914
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f69f040b8a784befab1556dc243e9ad8.IDENTIFIER=systemctl.

/run/systemd/journal/streams/.#9:2470508ZEwrp2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.340680585947308
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8BHRBVpdWd+g0Frqh:SbFuFyLVIg1BG+f+M8BxZU+r2jtWL0
MD5:	141A95C04B510A9977FDED6F6974BC6E
SHA1:	9EBD667EDD33B699D9296851361EA74DECA83F3A
SHA-256:	194AC09CBFE2FFD47150631625AB95BFE89E4C3BAC438C2DC86AA8838EC3D92A
SHA-512:	5170E7EE146B47883D91EA48DDF7CBA3293C4543D18D4F1F7206B08DF072B1A73FB60B52816572B748BC1324460B0CDA0B65BF9761813A94A35499BBF57AB2C4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6db2df837ae640478014d4d36b6d9b28.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:2470616iXLUz4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.445812240679857
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MxBFVCCgcG3NuqjNE:qgFq6g10+f+MHFV5wuQE
MD5:	17217E1B2F2C7D935CCB17D14D52BD4B
SHA1:	D6F49DE87B1CD69A5CC2D546074DE44FA0C0BE63
SHA-256:	3023A7B528E8CB105A4A1746B9E60F056764FE7E86749675B0C2E00E8E5C952E
SHA-512:	7DCC4179D850484E4959C68B1A8807A887F6BCA148F725F8D73F77CE3D5E23A0521F348750FF96141A50DFC8DB91EC1CBFFE51EE78A30B3C9F2B035C3E5CC497
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aff869e4d61c4076bf0f5d243fec49c9.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:2470774idFGW4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.35280951675254
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6WQsUUEwHDujs1Han:SbFuFyLVIg1BG+f+M6WQZw6joa
MD5:	FC861A0219919362DFF66A85EB568238
SHA1:	07454CBD4D36F2A71C46DBBEE1964B3056F0CB0E
SHA-256:	3D3DD890BF34CC7488D1A5B7CC07F9DB3ABBFFFDF269C7F768419163FDA5C22F
SHA-512:	21C7CDC15F48C3C50355F33295EE842E03D4F5E8A7716654F2C53FEA60DFC8F29D873C1AF1EB45BE718B30D8B07B0B829BA07A700651071E2D8B616F15202427
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=03457a96e01a4de0bcfb98ff705acae4.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:24973843pvWy5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.403009033551656
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpnDJqF21tBQN2jshP:SbFuFyLVIg1BG+f+Mpo0zQN2jbVC
MD5:	8C10B3EE4F290F2D292E1F2718769620
SHA1:	92C80FDC54BEBC38CEEB31671E74D8ACEC64C5A1
SHA-256:	68B99FFAAD645A5FFC7644E04A6F805309B6DA55DADC4DE3F7E042E2939A6567
SHA-512:	7D6EBFEC0F579BDD087D9E30C9C0849EBAD8BD9A85678ABDA14C30FDD07F4BFF5C81101E231B60C9AE6187AB7C296F6ECC30DDC6A75336EBE0701F0E82E5FF00
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c68423a8c520465f8d3e45df351ca9d5.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:75527okAUGE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.434723367557826
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+3R9Vk3cAaBBbXKsj:SbFuFyLVIg1BG+f+M+T23aBpRg2josQu
MD5:	9D6192C0540A0ADAC0D2A3C7A358BCCA
SHA1:	F79CA4BE096E52C004AED5E8B0F392384528874B
SHA-256:	3622ADAAC45A5F843152BD2A48203A178B07C666D39E94F55186842BB4A3F243
SHA-512:	B7F6DBC56054A1DE0045A9E4352DD3A124C91BE0B754058660FC07A1687F88874B8DB1B516DAD546D5AF4489FB4DB50E164A994611403485123F2614D67EB1BE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=427da241197043ff85a9c26a0bdd392e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:755436VFyyC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.357298205965384
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm4H/qODWyv8jsmNz0/:SbFuFyLVIg1BG+f+M4HV0jdCLKzK
MD5:	56D640287A6D931C9C62772FB7E78003
SHA1:	14994086E6C82884D909A5E67BE06556230B493C
SHA-256:	B3D9F867F2C0EC8870BCD81814A93C747E66E202F050C21AD894A7E151B1CED6
SHA-512:	6C4BFF95BADC2FA81D0EABBED55BBFE4E79435B87391FCAAB4C2B18455DA11BE34A5F4CB01B6DA3EA5D2DE6E34091A97522CA38B0B33F83AFDC8B7C8D7F82E9D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2b88d4a7efc342cba6ecdf3fc88da0fd.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:75547EwFgjD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.350787684510554
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyWzguUDnsy0jshQJT:SbFuFyLVIg1BG+f+MyWzguUDn70jtWL0
MD5:	91B14AA87EE629BF451690B697404BC2
SHA1:	519CD23823DE684DD90AF1C0E243B2D06CC80FB5
SHA-256:	30CF2D29CF5AAC846C520178C7A1A425BD6C3BCE5494F460A6524A039E80E49C
SHA-512:	2A52A1BC8AC2383FB98E05073C31D8961F8D431EDEF7C5D80F3243135A841CE896A0358A89D45FC69B2296F34357C2149CB22364119D28E4C0B2B33B39F02A71
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=89af6e6f48954dc396a683f4d9876e2e.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:756229N8DBF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.4423173911328036
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmodKmYiEXaXXVEFAgr:SbFuFyLVIg1BG+f+MoomYiX1+F2jNE
MD5:	F36D28FD451278BBD3CEC91BD73A3DAA
SHA1:	8B636284BA18D9548E158523E84B5A3EB976271D
SHA-256:	345D5B403A952017E69E2A1B08FF32FC4625F03F88610A299FCA89C0988AEA42
SHA-512:	C9AE41FA371F6788619FD753CB695D5DD83D331831B42DA3A53B5D5B933AB3F22BF608FFD64E6D6B36ABFD665DBEC912AA0D914411C23BC51D691788E8E20B0A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b64dfeef8488449bbc0a21f2253d2540.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:75623QlsciD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.430306417695247
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M8WsDzrFWMqjZcHcljX+:qgFq6g10+f+M85Dzr0MkmAu
MD5:	91C9D8BCA13A909B40943338B4805D79
SHA1:	C92715BC0AD1468A2BA3438B484487ECBB7EE0AC
SHA-256:	6775FCEDDA2695751E970AA314A935F0F67F85397EC193132BB788415A4EF69A
SHA-512:	9355D6116F4E041ACD7AD89E459C392C839197938A7DBDA2D559DFBC2AF8FDDFF333E5A2FF5FF91A6A9D5E762D181F7BFF112B4CD4297188808109C5545204C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=622709d9988e4be8b625e0620e099aee.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:756510qbYYF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.457737233302259
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuqNYYEP8jshKJveqC:SbFuFyLVIg1BG+f+MuqAP8jbVC
MD5:	6ECE249F73BBB46BBCF4CEA2A1159358
SHA1:	1D319D49114840B110E71F01BFCAC6C30873C022
SHA-256:	3441632D2B7DCAB9873F21B7D709B6D4F276E893BB99CE909F314E6E20F3809A
SHA-512:	D0A8641E1065E08CC21FE8AD96C0D0F617B3ED214D1266BD63C54033791E42837DA32DACFDA1DC7B2ACC44BAE783D5731543199785ED73F9290298A6DF1D8204
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d1227353bc2c46d9a56341b56f883f57.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:7571832NHrC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.401510674054662
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm6t3GWs2j8jswkClr+:SbFuFyLVIg1BG+f+M6RCjLkGq
MD5:	DB99AD116BCF66BF4DE352FDE559F36C
SHA1:	A44A84FED6893D5F272AC2FC733F0036135EF437
SHA-256:	179E6C89A67650943F1C5EA37BC0C5A3DE8A3ADB9C10297417C82F7802ECDA6F
SHA-512:	377F693C03D631BA036726712B409E372D5C8BE6C13F2F4C94CE9379963029ED0412D0483B3EEAA2EC98118F330BAC006A80FCB9627A43D17A9F49FB120AEE55
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=0cebbfed3d9f440c9d5fc816cf4ac9b6.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:76501XxRjPB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.562859808094771
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvkBRQ5N6DwSU2DVuf:SbFuFyLVIg1BG+f+MMQeDw2DVCF2ji4s
MD5:	583E7B523328ED1F2B9D1590A9A8B644
SHA1:	7C0D8B17DDF88E4068BD2070472A021D0FD4C601
SHA-256:	970B6CDA411E48372FB4F995F1D7CFF6E3E08E863DF8722BEEEFF02C6EDFAB2F
SHA-512:	6B84633DE65C436CD136DBD8F8E13E174D5C22FB68748562EF6BDE022D3F1F94ED8B507179DF8D0F760F7062D09C9AB5177CCCF882B03628650A1BCFAD91BADE
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e725145f642f449fb935851b31140782.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:76502PuoX8C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.491934778988118
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmuqqEV3ABWswsjs7LH:SbFuFyLVIg1BG+f+MueVMji4s
MD5:	0F63A93D99A2B87540AD8AC2AEA4BE3B
SHA1:	4D4646DC3F8C9F77328F65A866AEA83B2B41F564
SHA-256:	1B6AA417309A17D14F21E4FDA408F2EBE4286FCF072B52C33FA28810AEC8B204
SHA-512:	30F162FE5E0D0FDBF6745431941BF23956A27F3A42AC2AD258C1C1DD92C9FFF35DC827609FC1004EA1FA49D22E540802489EC70C468090228506C208374C9085
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d36424d7c7454030a6ab6e7cd0724bab.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:77808OR85FB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.537647806425271
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MW/1TROgqjFQMzKaBu:qgFqo6g7/+0+f+MK1D4Tmh
MD5:	FD2F3DA2F2438015DBF00A533F35C184
SHA1:	120401222AFEB7C06E565E4A785710147262186D
SHA-256:	68CBDD050D2669B6EA341BDA73E83A221D467F9193FC633BEF8AB344C87ADE82
SHA-512:	39FC80B3F4E18DA817858429E9DD7DC5B048702F836C229D7FBA4B708788336B839F5A96479C8BCA17F9498AC3143B29C79B3FCDC3B04429E3CB817241B26A0E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5d5623af0b154fcebf5c48627e8160d7.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77810ic8JoC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.503147270721287
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+M4HRgkb4E0jFQMzKaBu:qgFqdg7/+0+f+M4xH4E+Tmh
MD5:	3BC4F6B6CF2E5F351F2AC51D2A60D3AD
SHA1:	29A6636BA6B19985D3A21FB4DF811C325F1B5781
SHA-256:	3298669DEFC03CECB6AA09B0FFD260A39270CD36D7C090E19EC4C4E150FBAD92
SHA-512:	CFC8B51AAD58002E4A5E7A08EBFFD2211BFE1D816280178F910F636B7034F9B7B5A01AEEB8E08BAACF8ADBEFDA26816486C61EF55F2DBEB10EF370D38EBB52E7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2b8e73eed7944c89853cac1139d43e5a.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:77991ZLQ62D

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.4457837457128
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm8Dc1cUTDTdWYVjc5xsi:SbFuFyLVIg1BAf+M8Dc1pj4qjNALyAZD
MD5:	5136C83EA650AAAC66D89337DE950B25
SHA1:	81505E717645D9EF84621302915BF0D45CE79E2E
SHA-256:	C3D40FD8835687164EDA7020FE26BEC69BCB7B254740D4D6482C7595F0B01B13
SHA-512:	B3A649127AF12400D4F4434FB4C2ADD11CF9A96B05BA2097FC6F49E9E4E431DFCC246B482618A9742A0A08A5EDECE31396D2E3FF77B8B37A7B37F7DC87D04608
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6f9df9132c5345e6834311022537f941.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78080RnuTpF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.480925878183363
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8HpUcFqv8jNdQIeXD:qgFq6g1af+M86l22D
MD5:	DB26179B76D7D06238CC3C08BC158DF3
SHA1:	BB3802DA1E6F72378E11D910A87D34C6941696B9
SHA-256:	E4FC9BCE2ABCE90F4A67BAD7F6C4C8BD20A7165E27FB8FB12F6329CEFAC5AC6E
SHA-512:	89AE5603749B30A1A3E553ADB16005DD2B5EA07E5C2D01471624A0F22B8EC867D9637D8D604062F253897B083EB8EBD7C9EBDB33DB96F231100F6F39DCD2F8F6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6b61af8aeda143928c9646f97cb20370.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78090nKNqaC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	228
Entropy (8bit):	5.429654516579801
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoQwzS1fR8hTjsmNzC:SbFuFyLVIg1BG+f+MoQwKMjdCt/rRMtq
MD5:	D0A914E75D413B58D9A98DB48DA5EF7A
SHA1:	BE46118B6FEBBFA4749538A0C429B798F380EBC1
SHA-256:	5A37BA705374465D5349CD541440E1CFC2733E59390E1E6A7D81E3E2368E7D2B
SHA-512:	FBBA0225AC10AB63FA8D3CEBC7768E35E15C0D1A3C16B32BB13C3EF9100A90A29E7D20983F4CA65DE163CAD92ABACB9E9C6FAB857C279B979AE1762631D6CFAB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b2e67d1bdc004073b58a3190beab4118.IDENTIFIER=whoopsie-upload-all.UNIT=apport-autoreport.service.

/run/systemd/journal/streams/.#9:78183C86IeC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.415864142869536
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+MT5CAcV3sQ0hTjNTZD:qgFq6g1af+MRcVQTZD
MD5:	2EE2F85FED65695BA4DF6240DE74E85D
SHA1:	CBC75B408DE7C68BFBF68846C776E613EFBA2443
SHA-256:	B75681FE9E38337D6BF7CC207E0DD4E052217DA4163D4DC1922B3B97F5BC9329
SHA-512:	6C815C89DFDF18B4AED6592CB0B43AD178F8E5E5E766152C6EFD2C11D48B9F0EAF962050ED35F958BDC28D6B50E2FDFFF5E995D69D5685811DCFD7F752C289FA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=720479aa6bb04cbe9ebf5084a58f9e95.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:78217ZKyUTF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.449233655289624
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+Mu3IYdkhhTjLTTIWTIL:qgFq6g10+f+MCdkhpEWEL
MD5:	0441994189CCC2A0FFBF5F6F6328EF5B
SHA1:	2D215BA25B782CB3C1BF265EB8C57A9A2491CFB5
SHA-256:	DB82BED307D8B43A1D964E84DDEA80A43C97D79469D1068A545AA20BB77E5896
SHA-512:	3D9DD91D0FC8680F19F6A55D5D71692ABA7DB1AC1429EFCC677A407092341BBA3AE25ABFF7BF1B2963769374AE80843674FCBC3AC5481D642A7CC046C68253F7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d96db02e97b54faaba3cb881652612e6.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:78268zol90C

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.425187298645605
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MsejXOwxouqjNq:qgFqo6g7/+0+f+MsejXOuJwq
MD5:	B1E1259ED522856B321D646231E37A2B
SHA1:	1FB515D43159422F0DF234D9DA032D301F9BE3FA
SHA-256:	E5921B28EE2F192370193488638675C30956B656ADC6472336DA2D27625A59B8
SHA-512:	057658F9EC005825AB74AEE4E47BDF1A7D1D125A318E76CF5E309476CD35F7097EFA65316B4E1B078137C0C00D3091E5BF828F8D69E51825F7E1345E0CB38FB4
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f8d5416e04574b2d8e2a3619ec4d075e.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78270eI3MzB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4044598936201345
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmuJjksxhTjs2BDf8:SbFuFyLVI6g7/+BG+f+MuJwsxhTjNq
MD5:	99C1C1DB70C5A1ECF053B5039103CA34
SHA1:	3C99EDA2CBA80A2C3F755743EE6F7FB460AB3D28
SHA-256:	ACFB4E87E2FAD0CC215CAAE767365563EE38E9BA0C9478D8957D624DDA6B115A
SHA-512:	5D9063F2891139FB5F0DBF0E0D31FFF6C25F6C75F3A42915F3AA87867B6A3C863E4B1124321594646416D6C9A67F0D6D74DEB0F5545286DD48B4015339612AE5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d053afcdc1b74ad792f69a7c2a249dcd.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:78943QNFzvB

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.410645936217595
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmu8HSTYGHQRLH3Zjst:SbFuFyLVIg1BG+f+MuBYGOLJjdCLKzK
MD5:	F7744AD1BBE18E5C00D523DA12EFDE06
SHA1:	7EEAB2CADF1EED34C3314BDC418AD00170B0FE81
SHA-256:	FC3E11CA4F3193C606370D2E473E2F900ECCD7CA4229A393DB6EC29221938514
SHA-512:	DB4E3015CCFE438995BBC75693C8ACA7E9827F6380001325C09D4B3191C2FDB937008D55AA4E562F81B5D40D440D78B855BF284618C1B33A285C448599441B1F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d20af8029e184547994fbcb8613b31be.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:78970KAZjlC

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.45733618678979
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmr54rtdqcAUalDWAYJ:SbFuFyLVIg1BG+f+MeTANl9qjosQu
MD5:	978858DA7ED0DBFB50A13F87AF791D39
SHA1:	759ED60423BEAEA6ACDCC44210C2E415630D4609
SHA-256:	7E28CAACCAFFFA3B7ADEDD9018434B32646A00A41FD3B74C319E6CB9D729C7B3
SHA-512:	3D467B1A2861B4270369FA01FA785EAADE09B355ADB3441C83140543EE05EF017CC2D674632A5DAE25F4BD0C3D8D30337F1462E34CC46DEA94C22C13D54B4481
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a19fe80d4718476994732261635b3f3e.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:789870UmSCE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.406536546927819
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmpYWNM8hzvsjswkClK:SbFuFyLVIg1BG+f+MxNM8hz0jLkGq
MD5:	050FCEDB65CC760ABD170E7072E22722
SHA1:	47F269DAD568E308A9467FCBDF2D97D2D4992D5F
SHA-256:	CDF5958C256051F45C3ADE8DC79AE620C0E883CEBF613E775DDCE2DCA037089B
SHA-512:	5C79758BA99AD13481B959F49D714B683F17C8CAA09339F500D4D0F843F9EF0F4BA153CE6133C1015DD2C509FC4EF7B584A5F0D09DD0F6C93A3FFB2A321B7AA3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c8da328535a147f594c5d4a8b4c2d4c1.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:79024zHYK2B

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.492917497289872
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MusoiXCv8jZcHcljX+:qgFq6g10+f+M7orqmAu
MD5:	CAC4EC70F2B5D0CE7A80010EF28EEB75
SHA1:	2B209C698DC2F0A320E7B25F9929F30F92470AFC
SHA-256:	0ECC3C36F397BF4C048EF4803CB0C77B8981E88A78E5446E423F41DA3B0CCA19
SHA-512:	9CD3A8448A0BEE898E7D9F2A52F6A746E9C6920236B46659002475EBBABBF13ED8276B92DE546E07A64B1DF2C250CF01F498D1B74D6C334E48B04EDDBBFAF433
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=dd92bdf567e4470c834a73b5e83cb88b.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:79049AwQCfD

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.404679295971137
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm5zdqZKSzWOOWsh+sjsx:SbFuFyLVIg1BAf+MhdqQSSzTjNALyAZD
MD5:	4661FB14936B57A6C0D8A0DF2DEECE71
SHA1:	95FA1C6747EEC6F46693168DCC9F14C4A9DF321B
SHA-256:	A2EA24D468AB1735E099489DA595C95C820089CDA231E1788ED29EAD4C51EEB4
SHA-512:	A81DBF46FA7700C346DC7C3183AAFFAEFA95A9F141BF78C452E129A8F819CF742682941B1690EAB0A385DC7C1AE3A96E7C4F92CC1131408E2C4AB291BE87B9B2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=3caeb5680ea34c85b7e5f1639d1beeb1.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79070UBPkvE

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.417207023401929
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M8sMso7AYKvATjNdQIeXD:qgFq6g1af+M8JtEZvAF2D
MD5:	8334D7AFC5E00987646F3320D625269B
SHA1:	56F586484AB79159CA815A2CE1EE75ADD32BAC92
SHA-256:	6083A9AFC13903CA3575B981B873F02D3550CF760F3AF54C407256344EDA2E77
SHA-512:	EFACC452B8E71FDF21D7A5D302413BD86707F4AC13911311271995E6E587706ABB2E57B3241426EB995E331233C5F871D9989ED3ABFF6D992DAB8D12AE62457C
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=69802003363140ada63c944ff2e311f3.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:79124xSQdsF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.409685691312692
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MyXlR+4HQ5WsZjdCLKzK:qgFq6g10+f+M++4H8Ws3CLAK
MD5:	6294D9DB3A5E700F1F4A3CD7A8614245
SHA1:	0AA405F08DE8143D29BE6F8E3CD6CD2804BD7041
SHA-256:	D86DC43A952F283C93C37BEF5563710179F9EA28877A0812C86761EBE8C9068C
SHA-512:	1B087A3F4809A0670213D193A856859FE8ED67B61FE41EC929848A9451DC0F059B3EF5DE4F002EBEE956C731C26CA8BA563909550FE94504C39475AB99018964
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8767c19e401b4af88182f15f73d53bef.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:79813b7kTJR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	205
Entropy (8bit):	5.416130769824304
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm5ZVBdzSX5UwocOWwN:SbFuFyLVIg1BG+f+MHd+JUuZjbVC
MD5:	04AAECFC8CBA645BADC94627F179FDFF
SHA1:	4E38035DCE1B8C9E8A46E94300F373AF3BF4760C
SHA-256:	DE3CD827CF127CD2641C8BFC13A9C5FAA7061BC4E4A118C77E0584E15EE8DF19
SHA-512:	66E9E96E5C2F39134A29109AEB00E4A67AC9DA51E0204AAC8E8FD73E9DA0D9B1F0DEFB87C4365C01EB62E1FD19CBE06D42918BB7F09BC2D84C1D5314186A8AC5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=35c00f88f933402e91438cf74b596c00.IDENTIFIER=polkitd.UNIT=polkit.service.

/run/systemd/journal/streams/.#9:79839McUxkT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.405104493717944
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOdvP69ms947z+h6SnLAqC+h6KV+h6CQzuxm//xO2esMxsjs2BI:SbFuFyLVK6g7/+BG+f+MBOTsZjNq
MD5:	50CDE67FF4C1ACD9F750AB1D3A9E3CCA
SHA1:	CEABADDC7E358AAEC8F93FA31F177EDA40BA7EA0
SHA-256:	3F6EB0906E548A49C9CC14F96A2CF0BDBBB0B2C636F0944674295CF8B6AA9256
SHA-512:	A80B662A180B5512CD2C0393582E31578769D6A628976E506BBAC0C613E3AD62470370481A6BE33B25B5353DB0055F267F9BBDA54F5C58E4E69E2DDA68202FED
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5a33999f807943eaaaabd26b701f39c0.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79840tZ6mvQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	195
Entropy (8bit):	5.4488446219896405
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOfvP69ms947z+h6SnLAqC+h6KV+h6CQzuxmv5/VElQPXRBG0jk:SbFuFyLVI6g7/+BG+f+Mh/VEKPXRpjNq
MD5:	0BE47E3838B2907CE554EFFAD2601BA4
SHA1:	B7A7F94BD7D685B510A824F912D19C025BE9DF2F
SHA-256:	E63F291D8554173D08BAADA04DBA7BAAA46A2DAB8ADD1BBE7FE7FFEF5F2B6061
SHA-512:	CA37E690E7CA2897BDC8D86B2A7A4CF52F492E676A193190AD9AB3CB0BBFD88405D93C1C063D3E9FDBF156F676C34DBCF31D04E2A91A150A5787A746D6CDE853
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e8ebd8cbd1c44a369e3f91572c24dcb6.IDENTIFIER=gdm-session-worker.

/run/systemd/journal/streams/.#9:79870vmmp1R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.55144112524546
Encrypted:	false
SSDEEP:	6:SbFuFyLVK6g7/+BG+f+MseioRdjFQMzKaBu:qgFqo6g7/+0+f+Ms6NTmh
MD5:	9BC2DD6B1C5A7B3CB432DC05BD6F080E
SHA1:	56CCC3496320524B409E786F8B52A2781577C89F
SHA-256:	6A46014C8C2B50DA069F15DEC5FB46390C2126576C2D6FA62FD240497B141C59
SHA-512:	A6097DED54CA597C557AB562BDD6BC7EACADE6DBED8444D72991ABFD350335DFCF49EBE401B8C829FB209C17DEBE7B89F8791000CAF1CBB86A0D49D9867E1A3F
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=6.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fa55ec62c5b1438db4d9a2f72fe34794.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:79871WkOULU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.487508163506313
Encrypted:	false
SSDEEP:	6:SbFuFyLVI6g7/+BG+f+MyZGFM2jFQMzKaBu:qgFqdg7/+0+f+M7uETmh
MD5:	5DFE68CB1DB4A8503930DEA01B82733B
SHA1:	2A6CA82857BE53171D010DB9448538B519346872
SHA-256:	22212A276B11F23846BFE47EFB2420F5AF2D42C56E57104A8B2FF39FF501456C
SHA-512:	5C27BE6BE334C576264152957F0552075D659EC0EE9BB41DA17CDFF2410E6E655512355B67343D071B91E94730A4CFF2366E7327B0E62A0170B3A75674C5C882
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=4.LEVEL_PREFIX=0.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a0a8eb9bd0c1434ca9de3396735f0b6e.IDENTIFIER=/usr/lib/gdm3/gdm-wayland-session.

/run/systemd/journal/streams/.#9:803067bse3B

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.41475532550737
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzFT33YVMxsjsmNz0/:SbFuFyLVIg1BG+f+MxToyqjdCLKzK
MD5:	800381F18B92368D986719581BBA90C1
SHA1:	59FBD6328C532D3657002302F0867D60577EA3B9
SHA-256:	BC859517A18CDFB72544B15C1814FC159C5861D786969F8D25A5E5963383CCC9
SHA-512:	3E3460845CD2C0613914A03799F919B8142BB8F08D3E82A52D9FFF61866A0A353CABB39B91B20D52820CD871D1B52524F4DF10D0692FFCFBE5F384F25095D57A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=90f65394b1f44656988107f437b9356c.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:80320oW4SnF

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.431950043718311
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm8A2TTRZ0NDw2lsjsc:SbFuFyLVIg1BG+f+M8JT3r22josQu
MD5:	B2213C7FE33BD70931BC70B83C9DEB25
SHA1:	48860E737C47F8FC56CD0DDCBBDA0F94EC3A21A2
SHA-256:	2F2C249426E58BDE1484D1E0A8A788AB8327BF457A6DBBD48C96A0111FCD5105
SHA-512:	EFEBBB53B50A0CDB5A51B78C53F7A049E0037C117B4795BA1FC29C0D416A9F8E344E077C70A4236F0520562A65F18AD301C142D0CD4CBB3CA14790CF303ED6DC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=6ede662d592e4dbdbf3357168923ff8a.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81041H6KYJT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.541233964906015
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsWkMBzbxTjdurqjsv:SbFuFyLVIg1BG+f+MsWhBXxXbji4s
MD5:	A8DF1CEB766E31E60837AC0DF22268D2
SHA1:	0DF26009C2F9CD80F7432BA070379618B3C68803
SHA-256:	1CD8889B29E76D8CFE120A322A11EDCAD7EB574C6883C0B683C86C086D7D772E
SHA-512:	8EB23626F673E93561715632045927B20DB8F77FCFAB21970B8ABC35E97B4DB84B01B28BF0E023473699CA88B029305ECBCD1AE9964A69F41E930A76C31B66C6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=f270d717b58d409e84cca9fe364e1858.IDENTIFIER=journalctl.UNIT=systemd-journal-flush.service.

/run/systemd/journal/streams/.#9:81048MYpewQ

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.496729954295643
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M4KQsmuZjZcHcljX+:qgFq6g10+f+M4KvmuzmAu
MD5:	6518BE8086465EC81303A044B9B9E75D
SHA1:	8921A9C528FF042900E427D7B8DC6F9C9624C1CE
SHA-256:	F63A65D17D48190B9212AAC079CF2F03A99FA13C10C7AF175CE4ED6678A08ACA
SHA-512:	4C976FE5ACEB047926A91D1D48BD13E5E822185480A28BD848164DC0BB8EEDE15D1E97B2CCFFC854FEB4CA6A4324F91F5B3724FBB8ED2B5C9CB3049C6D1FDA6A
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=284c5fb0ff2c422f92616463c5bf622d.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81049VYooVT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.358335433711649
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmsAtdH3YnbxO0wsjst:SbFuFyLVIg1BG+f+Ms4+k0ZjdCLKzK
MD5:	27DC061B41D8B8369308A9A8E33FB591
SHA1:	47D38FDD8F3A7AA5EBCED3D004E7C6B47E841B66
SHA-256:	751DDF4F5449361877FEE98FF936F0A1DA403BD9B8F558E8AE044D5472E4B20D
SHA-512:	3E7C24B3207D854461E0DD2FEA8DEAE4F3DD4B8C596B1EDE3C46973EA7826CEE144004D94F9CCDEBF948A381B7F8BBC7F528B1C8E2D89369CE9B669D3EC34DFD
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=fe1ca388b1624bafa802b8db6205eca1.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:81050ruzLER

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.40369655853974
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmvVXnqS0DuQvh+sjsc:SbFuFyLVIg1BG+f+MJqvDuQ5TjosQu
MD5:	E159D82347A2CA594F36B27755908A7A
SHA1:	E22DB11C37B7AFB2DDCF1DA4F11243C9294EAA2B
SHA-256:	A3EDE32FA26DF4B249232BE6A96FB57CCF648351C18995015ED70B6A53DEE583
SHA-512:	E70097D9F7D9955C7D705CA0644A6B29BEBF41E2CD1E1138320FA9A6AA7A5061581D123F12CB4245932D7F9CB3DA99355AF7217077A645D0E60B843F6E1A36D2
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e37ceb71af2747e39af49fabb875e30c.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:81063LfejIT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.507785424775324
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm/yGqdvQBjRSBsjsig:SbFuFyLVIg1BG+f+Ma18DjZcHcljX+
MD5:	916FCF92C042904509AC9C8006E03AE8
SHA1:	1AFA770E2BA0566B6E03FACC79C2E45949F6ECB7
SHA-256:	C352606AD36131EE601647E4E4C0926F8E4CF7CDF80D0AF5CECA7B7A017FDA2D
SHA-512:	1F21C25A0DBC15B1672D0203A394EE37B36FEF22BB73C3FEE9736B56675E8587FE60E6FD0F0680CB92E218EB0A7F7AFCA34D2632A0E93F3177D7A3F498A859B6
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=59f2292b890849a4816d483bc45f2b42.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:81064bOZ1YT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.390733871553766
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm//k6VOmxxVWrqjswK:SbFuFyLVIg1BG+f+MBV3/ErqjLkGq
MD5:	72AE64DB465ED84C04AC60F2A462B0B1
SHA1:	C588F09D87757E7946019E598B919B9C11BF0ACE
SHA-256:	AA2AD860016DA75F7230F841E8BB0C0717DB7B65101428290639C0ACFFA540FC
SHA-512:	C252EC40C176C8D38D432F0A26CCA85E72DC55CEC30ED80ACCC077E239E9AE56ED9EE07FFE1BA61FB3043C4B4BA89622263C024F01D79ED793D783561478F7EA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=506f2eabac1541b290749c70b4c3ca05.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:810653ThJgR

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.396538791473296
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmupRhik1GBxAh22js2Ax:SbFuFyLVIg1BAf+MuhWxuZjNALyAZD
MD5:	880F3AEE39DB587FFA9E5AD4FE054B75
SHA1:	70119C54D56DE76EAE7282407300419E4453A8AE
SHA-256:	EF0A58B7D5DAE2560473E4A6BFD615BF8F4C1975AFB39853D55BFE82DD90BFDC
SHA-512:	C5D9C779526DF3A2D3B65B33F456E39D8AECFCB60AF50958B57D2A0DE107D23B94C9B2769EA8E5722F120A04D108B68B7EF3057A7BF53918889CDFFEB58EE84D
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=d13ec84cd077490189cda81f43f85ac4.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81147JaDeXT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.481521598652903
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmpKUEHtjv2js2BbQIeXD:SbFuFyLVIg1BAf+M5EH4jNdQIeXD
MD5:	5454AD74271EC1DF5EC90E400AF69A8F
SHA1:	F6DF3F6AF05204F783C9B793CF59F642DD763B98
SHA-256:	E8AA87D6A01B71749091A105A4323842DC5C7D10D2A8E2D23440BE52BD00BCFF
SHA-512:	EDA4D8520F9A7EDDF4280785932B6975139A7246A67D2EA4BF452429F0CDD6E0AF7A3A9418A95FB2F2634634022F1B0A3018B6290D711AC027D42A4C71868896
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c35743513f3e4ffdbb1158666b77a974.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81247gn1J9R

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.399897122925276
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm4DL4E6CzKGSRN2js2BP:SbFuFyLVIg1BAf+M4DLJ6Ci6jNTZD
MD5:	72293D6E71DD5BF411591D06C761E7B3
SHA1:	233D94C1956F6EDE968D4ACCD01F5581C7707FCD
SHA-256:	A8A6C05082D464686BDCD4C5951086624BB41148A88EA170B1A4E1AB8EACDD49
SHA-512:	A265375A43DB4B081688E976AA1D66B13F388F82AA41FEE41A0405BAB203754767BBCBF6A945C1CDB8C618E8F2CBCE8DC47684E5995B5CF75F333FA855216043
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2f012375aa05426883e329e2af4fc474.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:81332jtr14S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.423464782740944
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+M49JTMsB5qjLTTIWTIL:qgFq6g10+f+M49JTME+EWEL
MD5:	763A7C3BDC4500639F71C8D115299476
SHA1:	C0891E855AFA26A08A7D083C5AD96EC685015A5B
SHA-256:	7B0387A2F5D28897174A4663970E2DD61FA5582AE038D30ACDE8BB787239BD37
SHA-512:	D717A9B40AA7A6F0121FB5B93A5C6ECE3637DED51E4FB4CB011B1F298D93EF6022F1564942055C5006153EBE9CDFEC2B7FEBFBD6FA81BE031B7E9AE45A54FDA5
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=2ae64dad1adf455195f59b459e9fb27a.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/journal/streams/.#9:82282rCZJgU

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	189
Entropy (8bit):	5.386092554082982
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmoBuTWV+UjAg2js1Ha:SbFuFyLVIg1BG+f+MoBcWbZ2joa
MD5:	451A49CE708E71427AE4B32DC31E476B
SHA1:	E21C299A24B56EAA68ACBBBF92AFB448AA6AEA25
SHA-256:	3E51D56E61D4E2E36BCAFEC630C992DEFCEA22D00AACB6BED78DCE24BC4B0D24
SHA-512:	4DE87C8DB57ECD4FCFB3E20B0364AEA7B14EB832FFA45564C43904D860A386BDABAC21C05485B9975BBC9A0762F255F18634D05D51A31003E755DAACD08A98E0
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=bd50fea26bf1489e8266203183f175d6.IDENTIFIER=dbus-daemon.

/run/systemd/journal/streams/.#9:822955Du64S

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	5.352518684294023
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmp9QEgc8huqjshQJWQ:SbFuFyLVIg1BG+f+MfEcBqjtWL0
MD5:	88B9015CFB9A647664CFCA75385ED993
SHA1:	5352E5360D2C395CA7F3E9E0DF46215BC0B86931
SHA-256:	517CCF6464D33807EC595076FD8EA4A2DEBF5201B452A4009FB90986AF4AC8F4
SHA-512:	48F6CF1F54436C44765288BFBE9A75A3648D1C2C612A4261821622DBBCC3FF032C4BEDF66FFAF8D243E8B38A93688AE821C8D16491A0833B620BFCFC62147BDC
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=c0c90b59767a4180ba5a9c46542b22a9.IDENTIFIER=pulseaudio.

/run/systemd/journal/streams/.#9:82308YxJXmT

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	216
Entropy (8bit):	5.447232016446663
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm+hdITwEOoXDqcS5qO:SbFuFyLVIg1BG+f+M+0Tw1dqjNE
MD5:	6891F5D68780354AF89BB08ADDEDE359
SHA1:	EE185E8D3EFFCADA5742B556AAB93F52C06C5D08
SHA-256:	CC14A72437908A8A7E181422571E2BEAB4D4D189CFF8D23B668690AF6AB30BB2
SHA-512:	70C87EDF2255CA01816AD67EFB3113660291C1214B66F99271ECCF4CCE159964875D698412CA42AD7A265C4FCE937B477828BF7BDDBC72AB4A92801CAD1AD323
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=4bd1bcbf144449279d5412a6f2fe4697.IDENTIFIER=rtkit-daemon.UNIT=rtkit-daemon.service.

/run/systemd/journal/streams/.#9:912650JnDus6

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.409776659932095
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BG+f+MGFPEJmd5XF2jLkGq:qgFq6g10+f+M0ymd5XFnT
MD5:	4EB1DA32DB55C2BB468D33C64CA4D93D
SHA1:	510C1F816CAFEAB9F332A400F5056F66CB230C84
SHA-256:	782FAE26DF718D69B351C0627BEA9F110B24F383E6F422A746851D9A1356440A
SHA-512:	956D3199C41A3E9D1012B7F30482F578467A06BD320C942BC9D2E695F9F71F3BC5F580367A60956F840239451F730C8682D5B85A1CC8E345D90F0ADD496DAF41
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=5ab031b79a1546b6b2e4fbbadad67582.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:912651ERO273

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.3940347227909475
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmzO8VRFwh+YTjs1Ha7:SbFuFyLVIg1BG+f+MaEHdYTjosQu
MD5:	A7E4F2FCEAE047DD5AB455A39637CD27
SHA1:	CFFC6902991092504B251D7FD44E557B208FAED2
SHA-256:	E03C3C15DEE338257272E78F672B7D5F231312285003DE94E1B028AD8D456A19
SHA-512:	B0405CBECF87573F72535BDAC073573E88A5CFCD8446ACEFA579E74E907AB726AB1F3D8A979FA33FDE0597825D036CC0340235D9B5DBE0F99EBE1AEB5DF52D4E
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=9db6cfbb14d04633b4334d2af5e41cd5.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:912652nSqSq4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.494311458951828
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxm7kEvRnVhWDSdf0jsV:SbFuFyLVIg1BG+f+MbujZcHcljX+
MD5:	7F71FDEB8D6A1EA4BFB40B78F15D5CD7
SHA1:	13696CB761740188B24558EC81F79E4F78E7BC1D
SHA-256:	53CF92D587BEF197633F904D7CD664C83B9A48949E80300051AD71B0B891E322
SHA-512:	D5E4259B4A86D3D5D319AB4B9F5BC369D18654E737EE318D53B855A9D885602A3E4E2307BDBF14D7E60D2A0F129421CF878450D97E40F0DCFF77505B2D581264
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=1fd964b2ac6c44d09583fa1ae8f78fd8.IDENTIFIER=systemd-logind.UNIT=systemd-logind.service.

/run/systemd/journal/streams/.#9:912653Z4utJ3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.357187207954306
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmveXTBUoLVBUX7F2je:SbFuFyLVIg1BG+f+MQTikBUF2jdCLKzK
MD5:	1281AE8A969BFF0766E9584E1152F47F
SHA1:	271864A0AD6FE988C2F5EF371F067071F2189ADC
SHA-256:	D02D4579AE58BC8B2A19ED80E06DCA0DF8331F6210E8452B505E2F21857B871A
SHA-512:	25731F85698B570BD37EA85E28E06A8D008D1C231BC104FACEF4ED20A74311220BEEBA7628F07F8942D444E8C4A1905AEB578B97F07BDE26E080133504881DEA
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=e2b7826d0de84ce181711e65cb13620d.IDENTIFIER=whoopsie.UNIT=whoopsie.service.

/run/systemd/journal/streams/.#9:912654kM98T5

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	207
Entropy (8bit):	5.421134435227841
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmyARGobVdM2rqjs1Ha:SbFuFyLVIg1BG+f+My0ZVXrqjosQu
MD5:	CC8E1EF1E2EF16295089859E1A1441FE
SHA1:	511F1470807B3596215848D86BECB21AC13DA053
SHA-256:	DCDF93079F907BB6CAC25565DB020C321B796CE89E3506A9B22696595E5C425A
SHA-512:	B754B6F9B9E16E919D159EF7B1DD0DF6C3E19B65C925D133871468D083F8C024F7739873BCFBEA9B3F356175ACD008638D45727F4FE2ACACD076AA8BD13A7F36
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=8ea34cfc389449d8bbe25ee728caab67.IDENTIFIER=dbus-daemon.UNIT=dbus.service.

/run/systemd/journal/streams/.#9:912663sbr5E3

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	208
Entropy (8bit):	5.41909990294747
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmrqAgxihxN2jswkClK:SbFuFyLVIg1BG+f+Mx9gjLkGq
MD5:	9843AC4C10DAF9247208C2A9C7FC9A46
SHA1:	E0327F1C2C675D2B9A3839E3135F74AFB0246849
SHA-256:	85074F0F9EF41ACE4545DF009B19C193F4B312F2518DD8BA036DA49E0DDA5198
SHA-512:	42F68FDDCDD55874D0CB298861562D36FCBFE72D1634A35F4B80FA034C27EC6B20C57BD0064D8F9DB3AEA2FBEA75EA05A1576DA246D443BBC5D96915774EFCEB
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=aea14b63e67f422eb4393bf5c4d5899e.IDENTIFIER=agetty.UNIT=getty@tty2.service.

/run/systemd/journal/streams/.#9:912670zIMpP4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	210
Entropy (8bit):	5.361253507977024
Encrypted:	false
SSDEEP:	6:SbFuFyLVIg1BAf+M/DjhJHRAv8jNALyAZD:qgFq6g1af+M/DbHY+IZD
MD5:	B102B1EF7109FC5D81B23C193F5E4097
SHA1:	44D5EC3376C2CE4F98F3A8936D346F497F9B54CE
SHA-256:	3731B27F7A990EE29A282E862F77078DADA8167426680498BF1AB5D17325BCC8
SHA-512:	9F11DDBE0216ACA42F5C1FD9C6EB20ED3077A64A1B3A72855F1C8847907CEFCCB21ED7AA93C8B46528A71E45D58FAC370365A28A59578EAC0CC23D3D4A1A7FB3
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a7adfd77ccf0478cac4fd03ec31b3b4e.IDENTIFIER=generate-config.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:9127568qpAd4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	211
Entropy (8bit):	5.458864162391641
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxm+8jiRlRDH4n9Wg7Rvsy:SbFuFyLVIg1BAf+M+BRUn9l0jNdQIeXD
MD5:	C128D45E37D2AD9193E85DB0711ABF4C
SHA1:	370D3D7062773D9E7F19ECF83B95EFA95939A5AE
SHA-256:	B0D5EC4B290AAC1F2BC5C6CA8D8DE3C07B7E4A57019704A6FBFD08F96807F4B4
SHA-512:	14A93DE617F49DE711E037A6E43374087D45CEA030DEA12A4933CA9C6A8FC223033380627BEB6DBBF601FBE26C197E94195CB42085497C971198FC0063C54365
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=402de75744d64fb496716602c445e324.IDENTIFIER=gdm-wait-for-drm.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:912887S87OU4

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	199
Entropy (8bit):	5.426836773171257
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLCHh6KV+h6CQzuxmoKeL6HGGhg2js2BZZGu:SbFuFyLVIg1BAf+MorLeGWjNTZD
MD5:	4D186F1E3116B55DECE7BB4E0DE6F7AD
SHA1:	C8E5BF4BDE4BD9B2EC3FA2DAC508BB821D1A4C0C
SHA-256:	3C5BE94BEBE4E1B65C91E41335996B2D50E9210FA8295D8E67D58A381C12165E
SHA-512:	A086C521D369AC85BE1128CE63E683628868A02423AEAE3CB1317485E8E97A81A2540A6736BE77ACFD9C269B64878EA876BBB657B187447F72715EAC08899C63
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=1.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=b533132cc9d647a3b0828af26d4b24c5.IDENTIFIER=gdm3.UNIT=gdm.service.

/run/systemd/journal/streams/.#9:912984cMFhL2

Download File

Process:	/lib/systemd/systemd-journald
File Type:	ASCII text
Category:	dropped
Size (bytes):	222
Entropy (8bit):	5.36432960117722
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsPOYsn9ms954Hh6SnLAqC+h6KV+h6CQzuxmruK8GyXikglsjswxM:SbFuFyLVIg1BG+f+MynTjLTTIWTIL
MD5:	EEA8863F59150E3F937B3F8BEC2D5ED2
SHA1:	B0F56AB8E3914F5832157808C34F9159F5013FEE
SHA-256:	9C42479535C4E0545AE313A3E833E68D47B38DB9B10702BC96D03282F966D28E
SHA-512:	EDD8541F61CE7CBBA9D80E805183392C14DDF3C389916200B93A9144BA41930387B72BC1374407E2F189C168423F52724D38DB91A340F4C5B4E7EF6666696CF7
Malicious:	false
Preview:	# This is private data. Do not parse.PRIORITY=30.LEVEL_PREFIX=1.FORWARD_TO_SYSLOG=0.FORWARD_TO_KMSG=0.FORWARD_TO_CONSOLE=0.STREAM_ID=a0a5d602308c4155a34a303138ea9911.IDENTIFIER=accounts-daemon.UNIT=accounts-daemon.service.

/run/systemd/seats/.#seat06xnQR1

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0BNb1OL

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Ik7ETj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0Mcx9Ix

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0gKZ0Uf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

/run/systemd/seats/.#seat0mhlnsh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0swijBh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/seats/.#seat0trHG3J

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	116
Entropy (8bit):	4.957035419463244
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+ugKQ2KwshcXSv:SbFuFyLwH47Pg20ggWunQ2rNXc
MD5:	66D114877B3B4DB3BDD8A3AD4F5E7421
SHA1:	62E0CB0F51E0E3F97BE251CB917968DFF69ED344
SHA-256:	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
SHA-512:	5651247FA236DCF020A3C8456E4A9A74A85C5B9B3CCE94A3CF8F85FD4D66465C9F97DF7A1822E6CA4553C02BE149F3021D58DCC0C8CB6DCF37F915BD0A158187
Malicious:	false
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.SESSIONS=c1.UIDS=127.

/run/systemd/users/.#1273GiVrj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473843876084241
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8DJgzfc/Gnt6rTj:qgFq30dABibBEDJgzfcwID
MD5:	592D81B2DEF06F5D638DEFC9968B8E04
SHA1:	43E9A2893BAFAC5ED5F1CF70E39C4052652DF8A2
SHA-256:	A12263719B40F60AEE7E96E9550E58993DBCE3E75D842E9B8502B3066C6D65D5
SHA-512:	5D165D737B8BC9442B63C98E28E7FF8349CDB985F02E90D260F53E3F9A2B6C427EFE20D015F218D81447E0EEFB01CA1300BE0B11D56F94BBF9693F9A9BF77BBF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14747.REALTIME=1735407881570071.MONOTONIC=586333946.LAST_SESSION_TIMESTAMP=586431631.

/run/systemd/users/.#1274YLCfk

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.308107470767122
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8Y0Jgzfc/GM2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEY0JgzfcuthQHtPYb
MD5:	DE3CE37154B6FDCEEB1802BD9D40DF2A
SHA1:	E5878C38C5C905DAE911CEF1812B34054A4CD0AF
SHA-256:	288DC7EC95B9FE1E2AE2BF41A4E1CA1F6842C11AB2457692DD11B0BF6489FB3D
SHA-512:	2140702988DE4BE10EE9DC2C7EFF23495B23B0B1BB1519ED5A2E6EF75C7B2ECFE846607A2BF841BCEBA8D4B58C0E7733E0CF5A1A084BC309ED0061199A6DB79C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14565.REALTIME=1735407881570071.MONOTONIC=586333946.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#1274vSwfh

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.473843876084241
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0Ixff8DJgzfc/Gnt6rTj:qgFq30dABibBEDJgzfcwID
MD5:	592D81B2DEF06F5D638DEFC9968B8E04
SHA1:	43E9A2893BAFAC5ED5F1CF70E39C4052652DF8A2
SHA-256:	A12263719B40F60AEE7E96E9550E58993DBCE3E75D842E9B8502B3066C6D65D5
SHA-512:	5D165D737B8BC9442B63C98E28E7FF8349CDB985F02E90D260F53E3F9A2B6C427EFE20D015F218D81447E0EEFB01CA1300BE0B11D56F94BBF9693F9A9BF77BBF
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14747.REALTIME=1735407881570071.MONOTONIC=586333946.LAST_SESSION_TIMESTAMP=586431631.

/run/systemd/users/.#127BRZqSe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.297753979495689
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffYxJgzVV/jt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBCgz/YthQHtPYq9M
MD5:	9D4EEC49C8B901D58A13D3224D9238F8
SHA1:	CC44918FC3AE58667B35F990C508E53BCCB65536
SHA-256:	80FCB2F13628F1877260A2C603B79669CA523A8FC662AC48A86DC56901E12999
SHA-512:	F4C410ADD686084EAF42A541B7971868B7F8D2C60759170664A506AE97FBD913F23190E013D8F04E4426435B070C8A000FF47FFC45DC40539AF07965616F4BF3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13766.REALTIME=1735407821383180.MONOTONIC=526147055.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127C1WnSf

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127CNh6hg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.308107470767122
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff8Y0Jgzfc/GM2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBEY0JgzfcuthQHtPYb
MD5:	DE3CE37154B6FDCEEB1802BD9D40DF2A
SHA1:	E5878C38C5C905DAE911CEF1812B34054A4CD0AF
SHA-256:	288DC7EC95B9FE1E2AE2BF41A4E1CA1F6842C11AB2457692DD11B0BF6489FB3D
SHA-512:	2140702988DE4BE10EE9DC2C7EFF23495B23B0B1BB1519ED5A2E6EF75C7B2ECFE846607A2BF841BCEBA8D4B58C0E7733E0CF5A1A084BC309ED0061199A6DB79C
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/14565.REALTIME=1735407881570071.MONOTONIC=586333946.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127DC87aJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127HKzWWI

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.313152946314041
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA+//2rqx4k/b6H206qodkuUVj:SbFuFyL3BVgdL87iesnAiRJgz2rqNDid
MD5:	CDFF432CDB3ABB1CD15EC79DEAF9DD4B
SHA1:	2889D96E7795FF6005E66FB70FA02042061D0F88
SHA-256:	F08065D0983AFA51C68842A2CC3979352513432F43A267429DCD4DFC12F03CD6
SHA-512:	A2C8877380709F6BDD93F554976CFE192516B365486A9D270319080D02960877B726D9064476E667000BEB5D40700EA63F501E7892E58CB31578BD5B61DC2BB6
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735407780128825.MONOTONIC=484892700.LAST_SESSION_TIMESTAMP=484977106.

/run/systemd/users/.#127O8LgDj

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	188
Entropy (8bit):	4.928997328913428
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgVuMI2sKiYiesnAv/XS12K2hwEY8mTQ2pJi22sQ2KkmD2pi:SbFuFyL3BVgVuR257iesnAi12thQc2p4
MD5:	065A3AD1A34A9903F536410ECA748105
SHA1:	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4
SHA-256:	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
SHA-512:	DB3C42E893640BAEE9F0001BDE6E93ED40CC33198AC2B47328F577D3C71E2C2E986AAAFEF5BD8ADBC639B5C24ADF715D87034AE24B697331FF6FEC5962630064
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127QXWEij

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.3260355607978696
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA+fJS/wQ5/UWi5206qodjNTjn:SbFuFyL3BVgdL87iesnAiRJgzfc/Gnt+
MD5:	3CCC3EEC14F999B9767C523FC17EF23C
SHA1:	A61FECD1A90F19557025686B7BAE2AAAC0443D35
SHA-256:	A66256F55C9E13AF8D35B92622B3B2D0A4A2C739620C39A36A9C8B45EFAC24D3
SHA-512:	199DA52C188C23BB2F395D40A579DE7A655EB1F9FE2266AC5EC90BE816D318AF7FE24E643164D464391FB540F156D411835EB11FEF5ADDAFD818AF30927CAD6B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735407881570071.MONOTONIC=586333946.LAST_SESSION_TIMESTAMP=586431631.

/run/systemd/users/.#127ZBYiYe

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	223
Entropy (8bit):	5.484375335929967
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgdL87ynAir/0IxffDrgzVV/Ct6V:qgFq30dABibBbrgz/6IV
MD5:	DCC7F8B3E3BAABA1D01C2599C187AC67
SHA1:	ACC7002C011227342B31B1626DC1FDF76C7648AB
SHA-256:	980EA2D7C41F429C57559CF6412A4F114A8CA0CBD951FC940BCA365011951253
SHA-512:	8DFB29CE8D0E74BDC7695EB4F5F46EBB017B6B3C37132EFA5495A5295875622ABC263F4566CC0F5916713079426C85F5C8913F639A85BAD3AAA4D25E6B8229AB
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=yes.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13828.REALTIME=1735407821383180.MONOTONIC=526147055.LAST_SESSION_TIMESTAMP=526229566.

/run/systemd/users/.#127jS1zHK

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281913066696509
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBgz2rqNHRsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgz2+NHKjthQHtPYb
MD5:	CA6B67648928488891A1FAE8DBE88A2B
SHA1:	509DD909F58782BE6182435DC31EEABE1BD04313
SHA-256:	F831D0FF41C993BA7A10E233664544E56C7CFEAE3C8765F85F5A66A1C3D20935
SHA-512:	D7D90BE3CE84F75E11C4AA4C2FB018834D50638E54EC0AC1AC52BB90BC124B7563FC3B41DC990E722FD03CCE8B8EC4AEA68CA2C2C2EE2B7CE1DB1E2B5FF22452
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1735407780128825.MONOTONIC=484892700.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nSAYaJ

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.281913066696509
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0Ixff66hBgz2rqNHRsQ2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBxgz2+NHKjthQHtPYb
MD5:	CA6B67648928488891A1FAE8DBE88A2B
SHA1:	509DD909F58782BE6182435DC31EEABE1BD04313
SHA-256:	F831D0FF41C993BA7A10E233664544E56C7CFEAE3C8765F85F5A66A1C3D20935
SHA-512:	D7D90BE3CE84F75E11C4AA4C2FB018834D50638E54EC0AC1AC52BB90BC124B7563FC3B41DC990E722FD03CCE8B8EC4AEA68CA2C2C2EE2B7CE1DB1E2B5FF22452
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/12410.REALTIME=1735407780128825.MONOTONIC=484892700.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/systemd/users/.#127nYRS2h

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	174
Entropy (8bit):	5.333191379750953
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMs5BuSgdNR2sKiYiesnAv/XSHxJgA+VPdTXvOW1m206qodpt:SbFuFyL3BVgdL87iesnAiRJgzVV/Ct6V
MD5:	F8B8CFF105FF590F157599D3C9A76CC2
SHA1:	B0DC6684949F093BE3F6B483CADFA34D1D54063D
SHA-256:	BF3958415273A97CB5D5CFB15D4E616311DFB94A50A10524713BCF0073A3B04A
SHA-512:	76196393CD4FFE9ACD1ED2E4EA3A90EE3173C2526B05126B3509B5B29C2935CA9662A7906DA45127A89639965149AAD0FF6BF1BD4C1E9C8CF578F4CE68C0396B
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=closing.STOPPING=no.RUNTIME=/run/user/127.REALTIME=1735407821383180.MONOTONIC=526147055.LAST_SESSION_TIMESTAMP=526229566.

/run/systemd/users/.#127zDghKg

Download File

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	282
Entropy (8bit):	5.297753979495689
Encrypted:	false
SSDEEP:	6:SbFuFyL3BVgVuR257iesnAir/0IxffYxJgzVV/jt2thQc2pb02/g2p9rwB:qgFq30VuR8L/ibBCgz/YthQHtPYq9M
MD5:	9D4EEC49C8B901D58A13D3224D9238F8
SHA1:	CC44918FC3AE58667B35F990C508E53BCCB65536
SHA-256:	80FCB2F13628F1877260A2C603B79669CA523A8FC662AC48A86DC56901E12999
SHA-512:	F4C410ADD686084EAF42A541B7971868B7F8D2C60759170664A506AE97FBD913F23190E013D8F04E4426435B070C8A000FF47FFC45DC40539AF07965616F4BF3
Malicious:	false
Preview:	# This is private data. Do not parse..NAME=gdm.STATE=opening.STOPPING=no.RUNTIME=/run/user/127.SERVICE_JOB=/org/freedesktop/systemd1/job/13766.REALTIME=1735407821383180.MONOTONIC=526147055.SESSIONS=c1.SEATS=seat0.ACTIVE_SESSIONS=.ONLINE_SESSIONS=c1.ACTIVE_SEATS=.ONLINE_SEATS=seat0.

/run/user/1000/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.9219280948873623
Encrypted:	false
SSDEEP:	3:k6:k6
MD5:	2BFA16C08C8C8AD45534B3C3499F7FE3
SHA1:	5F0E63E7E6C4127B4E2E50C9002880440DA56212
SHA-256:	DF02AA7A66746B0E4EA11CBAAEE7F098ED7688660512A1F737E05EDE0D1AA7C1
SHA-512:	EF15481CAAA15BC50B5973FA2F2246B15B66331A609EA9068FDAFD6B953E2E20F7E7B2A46E71371CD1F0FD26DB6600CB8E57219D1B68AFD357CFE3E757C1C21D
Malicious:	false
Preview:	6505.

/run/user/127/pulse/pid

Download File

Process:	/usr/bin/pulseaudio
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nBvn:Bvn
MD5:	D4E7D4B7D56269579B8FF4367B5CB9B9
SHA1:	B9269170E8FEEDC29E08E918A7A808140D94B1FB
SHA-256:	EBD787BC2D07FB1B4026CF1F3F166F50F02DC1175D09E09A92E09206F7368A44
SHA-512:	AEA99B2BB78E10283E3D352B909F93171D3BC684E205862F7D9B28D545F4B5AB4EE858DA7853A5014475171850499B1B3769A5F6C64E52E22DBD29A0CED5E38C
Malicious:	false
Preview:	7124.

/run/utmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:lCsXlXEWtl/jlzCD/l:lf+ylLlzC7
MD5:	B77C6DD6B48301EF7AA40C2A6E9008E2
SHA1:	284FF1ED0552F279AA06DBBB41095E369F8149B1
SHA-256:	CA5A3B173586AB903D579B46AAF43E08DC2F56D37D736201DEA379ADB61E1C52
SHA-512:	45BAD072F738FAEB4CBB3487D55A05825AA505327977F372F1DC5D4AB395CE43CD38162206608E5F19B57DFE5982B43FD2EA1F1818CFF4810D075BE2D364C038
Malicious:	false
Preview:	....q...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................q....8pg[.......................................

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n6:6
MD5:	8171A51385511C68C3EF45E4DE358A3B
SHA1:	3241C5CBDAD2333645A6446A188310C8F99C949E
SHA-256:	39DF992D0F089431559EB6CD57C8544C3092E3FCE540B7EE219EBCCF7EEA6FB6
SHA-512:	978144EA47C62E8110C757F2BAECE0816AE018021D527D35DE87828FDD6EA4C05BF55F1D1CE2364E21EAA344049C09BB71F003BCF59EF41878ABFA3CF7F6E117
Malicious:	false
Preview:	7132.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nGvn:4
MD5:	6489C1E07CD0133458B5F9EE1D9BAC05
SHA1:	1BBE10FB346E960456D388392AAD3C7F4FD325AA
SHA-256:	075D1FEA8444B281D25948B4D74B1A8A51B1A8AEEE5F5AB50432A33A26204FEE
SHA-512:	42E258FB1374DC08AC042A715E93CCA30396D57B92F97AF908F178029266DBE71FE879BB915788627B25AB567B420587C1EA7D87128AE071239F44583855D1B2
Malicious:	false
Preview:	7123.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:n5q:5q
MD5:	3A7F82AFD2B368F8BB8734F85905B425
SHA1:	0C3F56D01A71B8187255D67A4438F736207E46E1
SHA-256:	311292DD940448C0BDEE5A6A8521FF93E4297A2B0C94FA0764E51AA51B5B4B37
SHA-512:	A01EFDC1FAE568C18F22BB7BA188558548020C1FB342F1A4A73DB4ECB6DF98F2A7ED09E2108C44801F77F89764C625361246BB6DAB76422C5B5D845C037DCEE1
Malicious:	false
Preview:	7106.7107.

/sys/fs/cgroup/systemd/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nBvn:Bvn
MD5:	D4E7D4B7D56269579B8FF4367B5CB9B9
SHA1:	B9269170E8FEEDC29E08E918A7A808140D94B1FB
SHA-256:	EBD787BC2D07FB1B4026CF1F3F166F50F02DC1175D09E09A92E09206F7368A44
SHA-512:	AEA99B2BB78E10283E3D352B909F93171D3BC684E205862F7D9B28D545F4B5AB4EE858DA7853A5014475171850499B1B3769A5F6C64E52E22DBD29A0CED5E38C
Malicious:	false
Preview:	7124.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:n6:6
MD5:	8171A51385511C68C3EF45E4DE358A3B
SHA1:	3241C5CBDAD2333645A6446A188310C8F99C949E
SHA-256:	39DF992D0F089431559EB6CD57C8544C3092E3FCE540B7EE219EBCCF7EEA6FB6
SHA-512:	978144EA47C62E8110C757F2BAECE0816AE018021D527D35DE87828FDD6EA4C05BF55F1D1CE2364E21EAA344049C09BB71F003BCF59EF41878ABFA3CF7F6E117
Malicious:	false
Preview:	7132.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/dbus.socket/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nGvn:4
MD5:	6489C1E07CD0133458B5F9EE1D9BAC05
SHA1:	1BBE10FB346E960456D388392AAD3C7F4FD325AA
SHA-256:	075D1FEA8444B281D25948B4D74B1A8A51B1A8AEEE5F5AB50432A33A26204FEE
SHA-512:	42E258FB1374DC08AC042A715E93CCA30396D57B92F97AF908F178029266DBE71FE879BB915788627B25AB567B420587C1EA7D87128AE071239F44583855D1B2
Malicious:	false
Preview:	7123.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/init.scope/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	10
Entropy (8bit):	2.2464393446710154
Encrypted:	false
SSDEEP:	3:n5q:5q
MD5:	3A7F82AFD2B368F8BB8734F85905B425
SHA1:	0C3F56D01A71B8187255D67A4438F736207E46E1
SHA-256:	311292DD940448C0BDEE5A6A8521FF93E4297A2B0C94FA0764E51AA51B5B4B37
SHA-512:	A01EFDC1FAE568C18F22BB7BA188558548020C1FB342F1A4A73DB4ECB6DF98F2A7ED09E2108C44801F77F89764C625361246BB6DAB76422C5B5D845C037DCEE1
Malicious:	false
Preview:	7106.7107.

/sys/fs/cgroup/unified/user.slice/user-127.slice/user@127.service/pulseaudio.service/cgroup.procs

Download File

Process:	/lib/systemd/systemd
File Type:	ASCII text
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:nBvn:Bvn
MD5:	D4E7D4B7D56269579B8FF4367B5CB9B9
SHA1:	B9269170E8FEEDC29E08E918A7A808140D94B1FB
SHA-256:	EBD787BC2D07FB1B4026CF1F3F166F50F02DC1175D09E09A92E09206F7368A44
SHA-512:	AEA99B2BB78E10283E3D352B909F93171D3BC684E205862F7D9B28D545F4B5AB4EE858DA7853A5014475171850499B1B3769A5F6C64E52E22DBD29A0CED5E38C
Malicious:	false
Preview:	7124.

/tmp/qemu-open.xHu8uW (deleted)

Download File

Process:	/tmp/wlw68k.elf
File Type:	data
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.9979526986606917
Encrypted:	false
SSDEEP:	3:Tg6STsHJN:Tg6SqJN
MD5:	BF3111512D872AB9E3B5A48F0AC80966
SHA1:	03B3640020F5687894E33E25C95FC7568D1C7CB1
SHA-256:	F4210DA08F35288FB3DEDBD7C658D9F05C3E77AB90788EA6EA4CCAC7E29BEE0B
SHA-512:	B96928302693ED844F0B671BB7198095ABEF666CE81EF389C904F1FDA80A4D70C1260E5266C13AA6391B274977140AF7CC0B725C67F36D5E6A565A3361888036
Malicious:	false
Preview:	/tmp/wlw68k.elf.nwlrbbmqbh

/var/lib/AccountsService/users/gdm.G8KIZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.L41PZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/AccountsService/users/gdm.OOMYZ2

Download File

Process:	/usr/lib/accountsservice/accounts-daemon
File Type:	ASCII text
Category:	dropped
Size (bytes):	61
Entropy (8bit):	4.66214589518167
Encrypted:	false
SSDEEP:	3:urzMQvNT+PzKLrAan4R8AKn:gzMQIzKLrAa4M
MD5:	542BA3FB41206AE43928AF1C5E61FEBC
SHA1:	F56F574DAF50D609526B36B5B54FDD59EA4D6A26
SHA-256:	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
SHA-512:	D774B8F191A5C65228D1B3CA1181701CFCD07A3D91C5571B0DDF32AD3E241C2D7BDFC0697AB97DC10441EF9CDC8AEE5B19BC34E13E5C8B0B91AD06EEF42F5AEA
Malicious:	false
Preview:	[User].XSession=.Icon=/var/lib/gdm3/.face.SystemAccount=true.

/var/lib/ubuntu-drivers-common/last_gfx_boot

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	25
Entropy (8bit):	2.7550849518197795
Encrypted:	false
SSDEEP:	3:JoT/V9fDVbn:M/V3n
MD5:	078760523943E160756979906B85FB5E
SHA1:	0962643266F4C5537F7D125046F28F21D6DD0C89
SHA-256:	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
SHA-512:	DEFAAE8F8B54C61A716A0B0B4884358FEB8EB44DFEA01AAA5A687FDA7182792B7DEBB34AA840672EB3B40EB59FD0186749E08E47D181786C7FAA8C8F73F0104D
Malicious:	false
Preview:	15ad:0405;0000:00:0f:0;1.

/var/log/auth.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	1319
Entropy (8bit):	4.885672969147577
Encrypted:	false
SSDEEP:	24:NpZeaZXGZrp8AcAvxcA2+Vv/+0pYrIJrT8:Nj8N5xvxxfVvZYrurI
MD5:	E8B56B84717A9EB1F45E8D1F336FC1A9
SHA1:	58400EBC0B82304823851DEDC84CAC7B3D5C9A26
SHA-256:	E4A0B3B29224027FD898D2B3AD0A6310F91E08A56955404C05D464AE0F1FCCDB
SHA-512:	5EF2409AF5532504F014E30FBD34332FA20219F62A82B71EA1B74529C41ABAC46C199954886054DC3A5052943F12388E2CE6662F464CF9D0F0FBA975AEA88DCF
Malicious:	false
Preview:	Dec 28 11:44:27 galassia systemd-logind[6984]: Failed to add user by file name 1000, ignoring: Invalid argument.Dec 28 11:44:27 galassia systemd-logind[6984]: User enumeration failed: Invalid argument.Dec 28 11:44:27 galassia systemd-logind[6984]: User of session 2 not known..Dec 28 11:44:27 galassia systemd-logind[6984]: Session enumeration failed: No such file or directory.Dec 28 11:44:27 galassia systemd-logind[6984]: Watching system buttons on /dev/input/event0 (Power Button).Dec 28 11:44:27 galassia systemd-logind[6984]: Watching system buttons on /dev/input/event1 (AT Translated Set 2 keyboard).Dec 28 11:44:27 galassia systemd-logind[6984]: New seat seat0..Dec 28 11:44:41 galassia gdm-launch-environment]: pam_unix(gdm-launch-environment:session): session opened for user gdm by (uid=0).Dec 28 11:44:41 galassia systemd: pam_unix(systemd-user:session): session opened for user gdm by (uid=0).Dec 28 11:44:41 galassia systemd-logind[6984]: Failed to start session scope session-c1.scope

/var/log/gpu-manager.log

Download File

Process:	/usr/bin/gpu-manager
File Type:	ASCII text
Category:	dropped
Size (bytes):	1371
Entropy (8bit):	4.8296848499188485
Encrypted:	false
SSDEEP:	24:wPXXX9uV6BNu3WDF3GF3XFFxFFed2uk2HUvJlfWkpPpx7uvvAdow9555cJz:wPXXXe6vejpeC2HUR5WkpPpcvAdow95O
MD5:	3AF77E630DA00B3BE24F4E8AA5D78B13
SHA1:	BCF2D99E002F6DE2413A183227B011CFBEF5673D
SHA-256:	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
SHA-512:	8524B1E8A761F962B32F396812099B9B0B2DCF3C9FCA8605424753CFCFF4DC67EDC5EE1D8C91B9C0ED7FAE6BB1E752898B8D514B7C421D1839D6FEDA609C593C
Malicious:	false
Preview:	log_file: /var/log/gpu-manager.log.last_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.new_boot_file: /var/lib/ubuntu-drivers-common/last_gfx_boot.can't access /run/u-d-c-nvidia-was-loaded file.can't get module info via kmodcan't access /opt/amdgpu-pro/bin/amdgpu-pro-px.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/kernel.Looking for nvidia modules in /lib/modules/5.4.0-72-generic/updates/dkms.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/kernel.Looking for amdgpu modules in /lib/modules/5.4.0-72-generic/updates/dkms.Is nvidia loaded? no.Was nvidia unloaded? no.Is nvidia blacklisted? no.Is intel loaded? no.Is radeon loaded? no.Is radeon blacklisted? no.Is amdgpu loaded? no.Is amdgpu blacklisted? no.Is amdgpu versioned? no.Is amdgpu pro stack? no.Is nouveau loaded? no.Is nouveau blacklisted? no.Is nvidia kernel module available? no.Is amdgpu kernel module available? no.Vendor/Device Id: 15ad:405.BusID "PCI:0@0:15:0".Is boot vga? yes.Error: can't acce

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlC+zQ/Xq+zQP:F3SRah
MD5:	E3FDD4D0040161EAF408207AC79A9DBA
SHA1:	B80D2A973319EF6B0646621AF9FC66AE54EB8147
SHA-256:	C561C232250CC9BF9E12AA07BCBFD6AF0F5439B05EF07A02D125F6D52A9B1F94
SHA-512:	BCC517A5D0115D7CD6F8468AD851FD8279E6D8CE1D18C51B9113B2EB09C1CA80396CB2B04847771D2024D290BD468AC84E03BC8B86946E4C5D3616FDEEA6D38A
Malicious:	false
Preview:	LPKSHHRH................2....#O8......mN................................2....#O8......mN........................................................................................................................................................

/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal

Download File

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4595260194504922
Encrypted:	false
SSDEEP:	3:F31HlAzX0qbeLVyIzX0qbeLV2:F3mnUn
MD5:	2A1A350F95C3812533C26E3AADA95736
SHA1:	5F98E71DEF0C15C6CD96266BF04DD195822684BF
SHA-256:	FA6DE706A9806451ACB4240511BCCECE80E68FD5E919552999FB2CB6A119C995
SHA-512:	5EF2CBC8259C94CA156E224F190E8053EBFD07BA0B04339C61DA758901BAB2E6FD04DB4E0DFCD9928F00931DEBC0AB507AEB6BED96E9D4164AE660213A0571C4
Malicious:	false
Preview:	LPKSHHRH................U...2Y@....0].................................U...2Y@....0].........................................................................................................................................................

/var/log/kern.log

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	12271
Entropy (8bit):	4.968207585301791
Encrypted:	false
SSDEEP:	96:j4u5X/7uyzFsuG70EUKG/j4/6YNAGGIgENss8Nk6J1J7iFG25Q7ogduCnSwHBc8t:jURf1qGnAXGlr8TuRVhHEkvrDnznkv
MD5:	041765F88ACDC0799613207A904507B8
SHA1:	2E42263EBB76B62B4FAAEAA5A66FEF495B6EAF8A
SHA-256:	4B41CDE7350D2E202A3EFC7FC8F2635E40FD2EDB0F3BDE46821CE5228DDCF0A1
SHA-512:	76341D54E785FC21C5BF2A5CE99B792B5A3085FDE0C24907787C645979C7D2D395F8F6173A032C80F175FBA003F67AA5531337B99205B71CDD6CE16BB139B667
Malicious:	false
Preview:	Dec 28 11:44:17 galassia kernel: [ 560.682038] blocking signal 9: 6257 -> 658.Dec 28 11:44:17 galassia kernel: [ 560.685668] blocking signal 9: 6257 -> 720.Dec 28 11:44:17 galassia kernel: [ 560.694769] blocking signal 9: 6257 -> 772.Dec 28 11:44:17 galassia kernel: [ 560.698422] blocking signal 9: 6257 -> 936.Dec 28 11:44:17 galassia kernel: [ 560.698956] blocking signal 9: 6257 -> 2048.Dec 28 11:44:17 galassia kernel: [ 560.863359] New task spawned: old: (tgid 6978, tid 6978), new (tgid: 6978, tid: 7045).Dec 28 11:44:17 galassia kernel: [ 560.863473] New task spawned: old: (tgid 6978, tid 6978), new (tgid: 6978, tid: 7046).Dec 28 11:44:17 galassia kernel: [ 561.524165] New task spawned: old: (tgid 7047, tid 7047), new (tgid: 7047, tid: 7048).Dec 28 11:44:17 galassia kernel: [ 561.525238] New task spawned: old: (tgid 7047, tid 7047), new (tgid: 7047, tid: 7049).Dec 28 11:44:17 galassia kernel: [ 561.528743] New task spawned: old: (tgid 7047, tid 7048), new (tgid: 7047, tid:

/var/log/syslog

Download File

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text, with very long lines (641)
Category:	dropped
Size (bytes):	30360
Entropy (8bit):	5.117492072536612
Encrypted:	false
SSDEEP:	768:juo3QkK2QkKeF3MYWUOCo5vDvl8L/vK33T9NrzkmW6eQM7kAqiptnr:SKaGL/vYrzgz
MD5:	82185B42D8608DB2515AC7B36CC73FD8
SHA1:	131232919927852D47A77093CC42CC2D2AF9E7AF
SHA-256:	F331E7421F7C80327BDD22791E916228E7482068A56B64B7AD540139BD87F364
SHA-512:	B01EFA24F0DAA249DF2638055799FE73AC711EC611B04952A8C3B181F533D2039A05758112AEA96CF0F2AC7AD69B50430669DFE547F0BABE82C843B1D80E3144
Malicious:	false
Preview:	Dec 28 11:44:16 galassia rtkit-daemon[6978]: Successfully called chroot..Dec 28 11:44:17 galassia kernel: [ 560.617593] systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 4..Dec 28 11:44:17 galassia kernel: [ 560.617607] systemd[1]: Stopped Journal Service..Dec 28 11:44:17 galassia kernel: [ 560.618642] systemd[1]: Starting Journal Service....Dec 28 11:44:17 galassia kernel: [ 560.671915] systemd[1]: systemd-logind.service: Main process exited, code=killed, status=9/KILL.Dec 28 11:44:17 galassia kernel: [ 560.671990] systemd[1]: systemd-logind.service: Failed with result 'signal'..Dec 28 11:44:17 galassia kernel: [ 560.672708] systemd[1]: systemd-logind.service: Scheduled restart job, restart counter is at 5..Dec 28 11:44:17 galassia kernel: [ 560.672717] systemd[1]: Stopped Login Service..Dec 28 11:44:17 galassia kernel: [ 560.672739] systemd[1]: Condition check resulted in Load Kernel Module drm being skipped..Dec 28 11:44:17 galassia kernel: [

/var/log/wtmp

Download File

Process:	/sbin/agetty
File Type:	data
Category:	dropped
Size (bytes):	384
Entropy (8bit):	0.6775035134351416
Encrypted:	false
SSDEEP:	3:lCsXlXEWtl/jlzCD/l:lf+ylLlzC7
MD5:	B77C6DD6B48301EF7AA40C2A6E9008E2
SHA1:	284FF1ED0552F279AA06DBBB41095E369F8149B1
SHA-256:	CA5A3B173586AB903D579B46AAF43E08DC2F56D37D736201DEA379ADB61E1C52
SHA-512:	45BAD072F738FAEB4CBB3487D55A05825AA505327977F372F1DC5D4AB395CE43CD38162206608E5F19B57DFE5982B43FD2EA1F1818CFF4810D075BE2D364C038
Malicious:	true
Preview:	....q...tty2.tty2.......................tty2LOGIN...............................................................................................................................................................................................................................................................................................q....8pg[.......................................

Source: global traffic	TCP traffic: 192.168.2.23:50016 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:53458 -> 178.215.238.153:33966

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.837331935040725
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	wlw68k.elf
File size:	180'160 bytes
MD5:	404cfb7607a7d6ec53599dc63ca4b591
SHA1:	6028edf8c069dedb9d1eab2190025b5494205165
SHA256:	06bd2d2ee2a9f7e6708bbc69a349696824645ab4a54c998062b509198289ec12
SHA512:	58f23988567ec8c223a20902951bfa825382c1030d6a201eb6b9c7e916e64fbb53d8aad903d94259fe88a4ebad906ffa8d4c341306ae2dfc6d8d67a9bf045226
SSDEEP:	3072:vfNjJWEnRMelQXNyELdWRGNPsBXM7N9Y+AVrjbioLTYy6N16MfM:9JAdyEBWRsPfXY+cLTYy6iMfM
TLSH:	70043AC7F800EDBEF80AE33704570919B130B7E150925B3762677A7BED3A1990567E86
File Content Preview:	.ELF.......................D...4...0.....4. ...(......................t...t....... .......t...........I0.......... .dt.Q............................NV..a....da...E.N^NuNV..J9....f>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy..t.N.X.........N^NuNV..N^NuN

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	179760
Section Header Size:	40
Number of Section Headers:	10
Header String Table Index:	9

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	2
.text	PROGBITS	0x800000a8	0xa8	0x2461e	0x0	0x6	AX	4
.fini	PROGBITS	0x800246c6	0x246c6	0xe	0x0	0x6	AX	2
.rodata	PROGBITS	0x800246d4	0x246d4	0x2de6	0x0	0x2	A	2
.ctors	PROGBITS	0x800294c0	0x274c0	0xc	0x0	0x3	WA	4
.dtors	PROGBITS	0x800294cc	0x274cc	0x8	0x0	0x3	WA	4
.data	PROGBITS	0x800294e0	0x274e0	0x4910	0x0	0x3	WA	32
.bss	NOBITS	0x8002ddf0	0x2bdf0	0x45b4	0x0	0x3	WA	4
.shstrtab	STRTAB	0x0	0x2bdf0	0x3e	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x274ba	0x274ba	6.2020	0x5	R E	0x2000	.init .text .fini .rodata
LOAD	0x274c0	0x800294c0	0x800294c0	0x4930	0x8ee4	0.4599	0x6	RW	0x2000	.ctors .dtors .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Dec 28, 2024 18:42:41.141216993 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable
Dec 28, 2024 18:44:01.151233912 CET	192.168.2.23	192.168.2.1	8283	(Port unreachable)	Destination Unreachable

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 18:41:51.094152927 CET	8.8.8.8	192.168.2.23	0x131f	No error (0)	raw.cardiacpure.ru	178.215.238.153	A (IP address)	IN (0x0001)	false
Dec 28, 2024 18:42:41.883702993 CET	1.1.1.1	192.168.2.23	0xe5bf	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false
Dec 28, 2024 18:42:41.883702993 CET	1.1.1.1	192.168.2.23	0xe5bf	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 18:44:22.165350914 CET	1.1.1.1	192.168.2.23	0xa54d	No error (0)	daisy.ubuntu.com	162.213.35.25	A (IP address)	IN (0x0001)	false
Dec 28, 2024 18:44:22.165350914 CET	1.1.1.1	192.168.2.23	0xa54d	No error (0)	daisy.ubuntu.com	162.213.35.24	A (IP address)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-12-28 17:42:47 UTC	307	OUT	POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1 Host: daisy.ubuntu.com Accept: / Content-Type: application/octet-stream X-Whoopsie-Version: 0.2.69ubuntu0.3 Content-Length: 164887 Expect: 100-continue
2024-12-28 17:42:48 UTC	25	IN	HTTP/1.1 100 Continue
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 17 84 02 00 02 50 72 6f 63 45 6e 76 69 72 6f 6e 00 4e 00 00 00 50 41 54 48 3d 28 63 75 73 74 6f 6d 2c 20 6e 6f 20 75 73 65 72 29 0a 58 44 47 5f 52 55 4e 54 49 4d 45 5f 44 49 52 3d 3c 73 65 74 3e 0a 4c 41 4e 47 3d 65 6e 5f 55 53 2e 55 54 46 2d 38 0a 53 48 45 4c 4c 3d 2f 62 69 6e 2f 62 61 73 68 00 02 5f 4c 6f 67 69 6e 64 53 65 73 73 69 6f 6e 00 02 00 00 00 35 00 02 44 61 74 65 00 19 00 00 00 54 75 65 20 41 75 67 20 31 37 20 32 30 3a 31 38 3a 30 34 20 32 30 32 31 00 02 53 6f 75 72 63 65 50 61 63 6b 61 67 65 00 0d 00 00 00 6c 69 67 68 74 2d 6c 6f 63 6b 65 72 00 02 50 61 63 6b 61 67 65 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 41 72 63 68 69 74 65 63 74 75 72 65 00 06 00 00 00 61 6d 64 36 34 00 02 44 69 73 74 72 6f 52 65 6c 65 61 Data Ascii: ProcEnvironNPATH=(custom, no user)XDG_RUNTIME_DIR=<set>LANG=en_US.UTF-8SHELL=/bin/bash_LogindSession5DateTue Aug 17 20:18:04 2021SourcePackagelight-lockerPackageArchitectureamd64Architectureamd64DistroRelea
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 72 75 6e 74 69 6d 65 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6d 2d 73 79 73 74 65 6d 64 20 32 34 35 2e 34 2d 34 75 62 75 6e 74 75 33 2e 31 31 0a 6c 69 62 70 61 6d 30 67 20 31 2e 33 2e 31 2d 35 75 62 75 6e 74 75 34 2e 31 0a 6c 69 62 70 61 6e 67 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 63 61 69 72 6f 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 66 74 32 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 6e 67 6f 78 66 74 2d 31 2e 30 2d 30 20 31 2e 34 34 2e 37 2d 32 75 62 75 6e 74 75 34 0a 6c 69 62 70 61 70 65 72 2d 75 74 69 6c 73 20 31 2e 31 2e 32 38 0a 6c Data Ascii: tu4.1libpam-runtime 1.3.1-5ubuntu4.1libpam-systemd 245.4-4ubuntu3.11libpam0g 1.3.1-5ubuntu4.1libpango-1.0-0 1.44.7-2ubuntu4libpangocairo-1.0-0 1.44.7-2ubuntu4libpangoft2-1.0-0 1.44.7-2ubuntu4libpangoxft-1.0-0 1.44.7-2ubuntu4libpaper-utils 1.1.28l
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 67 73 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 30 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 31 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 32 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 33 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 34 20 20 20 20 20 20 20 20 20 20 20 20 20 30 78 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 30 0a 6b 35 20 Data Ascii: 0x0 0gs 0x0 0k0 0x0 0k1 0x0 0k2 0x0 0k3 0x0 0k4 0x0 0k5
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 34 30 30 30 2d 37 66 37 39 31 63 30 37 35 30 30 30 20 2d 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 78 63 62 2d 72 65 6e 64 65 72 2e 73 6f 2e 30 2e 30 2e 30 0a 37 66 37 39 31 63 30 37 35 30 30 30 2d 37 66 37 39 31 63 30 37 36 30 30 30 20 72 2d 2d 70 20 30 30 30 30 63 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 Data Ascii: /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c074000-7f791c075000 ---p 0000c000 fd:00 806260 /usr/lib/x86_64-linux-gnu/libxcb-render.so.0.0.07f791c075000-7f791c076000 r--p 0000c000 fd:00 806260 /u
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 33 30 30 30 2d 37 66 37 39 31 63 37 37 34 30 30 30 20 72 77 2d 70 20 30 30 30 32 36 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 34 35 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 2d 6c 69 6e 75 78 2d 67 6e 75 2f 6c 69 62 67 64 6b 5f 70 69 78 62 75 66 2d 32 2e 30 2e 73 6f 2e 30 2e 34 30 30 30 2e 30 0a 37 66 37 39 31 63 37 37 34 30 30 30 2d 37 66 37 39 31 63 37 37 38 30 30 30 20 72 2d 2d 70 20 30 30 30 30 30 30 30 30 20 66 64 3a 30 30 20 38 30 36 32 36 38 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 2f 75 73 72 2f 6c 69 62 2f 78 38 36 5f 36 34 Data Ascii: nux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c773000-7f791c774000 rw-p 00026000 fd:00 806245 /usr/lib/x86_64-linux-gnu/libgdk_pixbuf-2.0.so.0.4000.07f791c774000-7f791c778000 r--p 00000000 fd:00 806268 /usr/lib/x86_64
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 37 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 70 6c 61 74 66 6f 72 6d 20 65 69 73 61 2e 30 3a 20 43 61 6e 6e 6f 74 20 61 6c 6c 6f 63 61 74 65 20 72 65 73 6f 75 72 63 65 20 66 6f 72 20 45 49 53 41 20 73 6c 6f 74 20 38 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 36 20 67 61 6c 61 73 73 69 61 20 6b 65 72 6e 65 6c 3a 20 73 64 20 33 32 3a 30 3a 30 3a 30 3a 20 5b 73 64 61 5d 20 41 73 73 75 6d 69 6e 67 20 64 72 69 76 65 20 63 61 63 68 65 3a 20 77 72 69 74 65 20 74 68 72 6f 75 67 68 0a 41 75 67 20 31 37 20 32 30 3a 32 34 3a 34 37 20 67 Data Ascii: platform eisa.0: Cannot allocate resource for EISA slot 7Aug 17 20:24:46 galassia kernel: platform eisa.0: Cannot allocate resource for EISA slot 8Aug 17 20:24:46 galassia kernel: sd 32:0:0:0: [sda] Assuming drive cache: write throughAug 17 20:24:47 g
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 4d 6f 64 75 6c 65 3a 20 22 66 62 64 65 76 68 77 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4c 6f 61 64 69 6e 67 20 2f 75 73 72 2f 6c 69 62 2f 78 6f 72 67 2f 6d 6f 64 75 6c 65 73 2f 6c 69 62 66 62 64 65 76 68 77 2e 73 6f 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 34 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 4d 6f 64 75 6c 65 20 66 62 64 65 76 68 77 3a 20 76 65 6e 64 6f 72 3d 22 58 2e 4f 72 67 20 46 6f 75 6e 64 61 74 69 6f 6e 22 0a 41 75 67 20 31 37 Data Ascii: 551]: (II) LoadModule: "fbdevhw"Aug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Loading /usr/lib/xorg/modules/libfbdevhw.soAug 17 20:25:04 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) Module fbdevhw: vendor="X.Org Foundation"Aug 17
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 39 32 30 78 31 32 30 30 22 20 28 69 6e 73 75 66 66 69 63 69 65 6e 74 20 6d 65 6d 6f 72 79 20 66 6f 72 20 6d 6f 64 65 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 65 28 30 29 3a 20 4e 6f 74 20 75 73 69 6e 67 20 64 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 39 36 30 78 36 30 30 22 20 28 62 61 64 20 6d 6f 64 65 20 63 6c 6f 63 6b 2f 69 6e 74 65 72 6c 61 63 65 2f 64 6f 75 62 6c 65 73 Data Ascii: /lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "1920x1200" (insufficient memory for mode)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmware(0): Not using default mode "960x600" (bad mode clock/interlace/doubles
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 20 31 33 33 36 20 31 35 32 30 20 20 38 36 34 20 38 36 35 20 38 36 38 20 38 39 35 20 2d 68 73 79 6e 63 20 2b 76 73 79 6e 63 20 28 35 33 2e 37 20 6b 48 7a 20 64 29 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 76 6d 77 61 72 65 28 30 29 3a 20 20 44 65 66 61 75 6c 74 20 6d 6f 64 65 20 22 31 30 32 34 78 37 36 38 22 3a 20 39 34 2e 35 20 4d 48 7a 2c 20 36 38 2e 37 20 6b 48 7a 2c 20 38 35 2e 30 20 48 7a 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 49 49 29 20 76 6d 77 61 72 Data Ascii: 1336 1520 864 865 868 895 -hsync +vsync (53.7 kHz d)Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (**) vmware(0): Default mode "1024x768": 94.5 MHz, 68.7 kHz, 85.0 HzAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: (II) vmwar
2024-12-28 17:42:48 UTC	16384	OUT	Data Raw: 65 64 20 53 65 74 20 32 20 6b 65 79 62 6f 61 72 64 3a 20 61 6c 77 61 79 73 20 72 65 70 6f 72 74 73 20 63 6f 72 65 20 65 76 65 6e 74 73 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 44 65 76 69 63 65 22 20 22 2f 64 65 76 2f 69 6e 70 75 74 2f 65 76 65 6e 74 31 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 3a 30 35 20 67 61 6c 61 73 73 69 61 20 2f 75 73 72 2f 6c 69 62 2f 67 64 6d 33 2f 67 64 6d 2d 78 2d 73 65 73 73 69 6f 6e 5b 31 35 35 31 5d 3a 20 28 2a 2a 29 20 4f 70 74 69 6f 6e 20 22 5f 73 6f 75 72 63 65 22 20 22 73 65 72 76 65 72 2f 75 64 65 76 22 0a 41 75 67 20 31 37 20 32 30 3a 32 35 Data Ascii: ed Set 2 keyboard: always reports core eventsAug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "Device" "/dev/input/event1"Aug 17 20:25:05 galassia /usr/lib/gdm3/gdm-x-session[1551]: () Option "_source" "server/udev"Aug 17 20:25
2024-12-28 17:42:50 UTC	279	IN	HTTP/1.1 400 Bad Request Date: Sat, 28 Dec 2024 17:42:50 GMT Server: gunicorn/19.7.1 X-Daisy-Revision-Number: 979 X-Oops-Repository-Version: 0.0.0 Strict-Transport-Security: max-age=2592000 Connection: close Transfer-Encoding: chunked 17 Crash already reported. 0

Start time (UTC):	17:41:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	17:41:51
Start date (UTC):	28/12/2024
Path:	/tmp/wlw68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	17:43:22
Start date (UTC):	28/12/2024
Path:	/tmp/wlw68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Start time (UTC):	17:41:50
Start date (UTC):	28/12/2024
Path:	/usr/libexec/gnome-session-binary
Arguments:	-
File size:	334664 bytes
MD5 hash:	d9b90be4f7db60cb3c2d3da6a1d31bfb

Start time (UTC):	17:42:33
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:35
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:39
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:40
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:41
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:42
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/gpu-manager
Arguments:	-
File size:	76616 bytes
MD5 hash:	8fae9dd5dd67e1f33d873089c2fd8761

Start time (UTC):	17:42:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report wlw68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink

/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source

/memfd:30-systemd-environment-d-generator (deleted)

/memfd:user-environment-generators (deleted)

/proc/6652/oom_score_adj

/proc/6956/oom_score_adj

/proc/7115/oom_score_adj

/run/gdm3.pid

/run/systemd/journal/streams/.#9:2470117UwBTQ4

/run/systemd/journal/streams/.#9:2470119aGBqi5

/run/systemd/journal/streams/.#9:247025310AHI6

/run/systemd/journal/streams/.#9:2470266Aqvm72

/run/systemd/journal/streams/.#9:2470268CGQjM2

/run/systemd/journal/streams/.#9:24704590rJDT3

/run/systemd/journal/streams/.#9:2470508ZEwrp2

/run/systemd/journal/streams/.#9:2470616iXLUz4

/run/systemd/journal/streams/.#9:2470774idFGW4

/run/systemd/journal/streams/.#9:24973843pvWy5

/run/systemd/journal/streams/.#9:75527okAUGE

/run/systemd/journal/streams/.#9:755436VFyyC

/run/systemd/journal/streams/.#9:75547EwFgjD

/run/systemd/journal/streams/.#9:756229N8DBF

/run/systemd/journal/streams/.#9:75623QlsciD

/run/systemd/journal/streams/.#9:756510qbYYF

/run/systemd/journal/streams/.#9:7571832NHrC

Linux Analysis Report
wlw68k.elf

Start time (UTC):	17:42:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	17:42:46
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:57
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:42:58
Start date (UTC):	28/12/2024
Path:	/usr/sbin/gdm3
Arguments:	-
File size:	453296 bytes
MD5 hash:	2492e2d8d34f9377e3e530a61a15674f

Start time (UTC):	17:43:00
Start date (UTC):	28/12/2024
Path:	/usr/lib/gdm3/gdm-session-worker
Arguments:	-
File size:	293360 bytes
MD5 hash:	692243754bd9f38fe9bd7e230b5c060a

Start time (UTC):	17:43:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/dbus-run-session
Arguments:	-
File size:	14480 bytes
MD5 hash:	245f3ef6a268850b33b0225a8753b7f4

Start time (UTC):	17:43:05
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:43:06
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75

Start time (UTC):	17:43:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	17:43:08
Start date (UTC):	28/12/2024
Path:	/usr/lib/systemd/systemd
Arguments:	-
File size:	1620224 bytes
MD5 hash:	9b2bec7092a40488108543f9334aab75